# Setup DB Action

A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.

The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.

**Docker-in-Docker:** If the job runs **in a container** and talks to a **DinD sidecar**, bind-mount sources must live on the volume **both** the job and the Docker daemon see. On GitHub-hosted-style setups that is typically under **`RUNNER_TEMP`** (e.g. `/home/runner/_work/_temp`). The default **`cache-dir`** is **`${{ runner.temp }}/trivy`** for that reason—see [this overview of DinD bind mounts](https://dev.to/devactivity/navigating-github-actions-dind-bind-mounts-insights-from-recent-github-reports-for-cicd-1c8). Configure your Gitea runner the same way, or set **`cache-dir`** to a path your platform documents as shared with DinD.

**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).

## Usage

### Basic Usage

```yaml
- name: Setup DB
  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
```

### Complete Example

```yaml
name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on:
      - ubuntu-latest
      - linux_amd64
    steps:
      - uses: actions/checkout@v4
      - name: Setup Trivy
        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
      - name: Setup DB
        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
      - name: Scan for vulnerabilities
        run: trivy fs .
```

## Inputs

| Input            | Description                                                                 | Required | Default |
| ---------------- | --------------------------------------------------------------------------- | -------- | ------- |
| `cache-dir`      | Trivy cache directory (created if missing; bind-mounted for DB download)     | No       | `${{ runner.temp }}/trivy` |
| `trivy-version`  | Docker image reference for Trivy (digest pin recommended)                   | No       | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |

**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.