# Setup DB Action

A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.

The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.

**Bind mounts and paths:** The default **`cache-dir`** is under **`github.workspace`** (`.trivy-cache`), not `${{ runner.temp }}`, because on many self-hosted or containerized runners the Docker daemon does **not** see the same filesystem as the job for `/tmp`—bind mounts then fail with “source path does not exist” even though the shell created the directory. If you set **`cache-dir`** yourself, use a path the Docker daemon can access (typically under the checked-out workspace).

**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).

## Usage

### Basic Usage

```yaml
- name: Setup DB
  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
```

### Complete Example

```yaml
name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on:
      - ubuntu-latest
      - linux_amd64
    steps:
      - uses: actions/checkout@v4
      - name: Setup Trivy
        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
      - name: Setup DB
        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
      - name: Scan for vulnerabilities
        run: trivy fs .
```

## Inputs

| Input           | Description                                               | Required | Default                                                    |
| --------------- | --------------------------------------------------------- | -------- | ---------------------------------------------------------- |
| `cache-dir`     | Path to the Trivy cache directory                         | No       | `${{ github.workspace }}/.trivy-cache`                   |
| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |

**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.