name: "Setup Trivy DB"
description: "Setup the trivy database, restoring from cache if available"
author: "Timo Behrendt <t.behrendt@t00n.de"
branding:
  icon: "database"
  color: "blue"

inputs:
  cache-dir:
    description: "Trivy cache directory on the job filesystem (default under runner.temp—shared with Docker-in-Docker sidecars; bind-mounted into the Trivy container)"
    required: false
    default: "${{ runner.temp }}/trivy"
  trivy-version:
    description: "Trivy docker image version to use (full image reference including digest is recommended)"
    required: false
    default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"

outputs:
  cache-dir:
    description: "Path to the Trivy cache directory"
    value: ${{ inputs.cache-dir }}

runs:
  using: "composite"
  steps:
    - id: current-date
      shell: bash
      run: |
        echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
    - name: Ensure Trivy cache directory exists
      shell: bash
      run: mkdir -p "${{ inputs.cache-dir }}"
    - id: restore-db
      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
      with:
        path: ${{ inputs.cache-dir }}
        key: trivy-db-${{ steps.current-date.outputs.current-date }}
        restore-keys: |
          trivy-db-${{ steps.current-date.outputs.current-date }}
    - if: steps.restore-db.outputs.cache-hit != 'true'
      shell: bash
      run: |
        docker run --rm \
          --name trivy-db-download \
          --user "$(id -u):$(id -g)" \
          --read-only \
          --env-file /dev/null \
          --cap-drop ALL \
          --pids-limit 64 \
          --memory=512m \
          --memory-swap=512m \
          --cpus=1 \
          --ipc private \
          --cgroupns private \
          --security-opt no-new-privileges \
          --security-opt apparmor=docker-default \
          --tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
          --mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \
          ${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache --offline-scan --exit-code 0