# Setup OSV Scanner Action

A reusable Gitea Action that downloads and sets up the osv-scanner binary for vulnerability scanning.

The downloaded binary is verified against a pinned SHA-256 digest for the runner architecture.

## Usage

### Basic Usage

```yaml
- name: Setup OSV Scanner
  uses: your-username/osv-scanner-actions@main/setup-osv
  with:
    version: "v2.4.0"
    amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
    arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
```

Digests are published in each release's `osv-scanner_SHA256SUMS` file (e.g. for `osv-scanner_linux_amd64` / `osv-scanner_linux_arm64`). You may pass either bare hex or `sha256:<hex>`.

### Complete Example

```yaml
name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on:
      - ubuntu-latest
      - linux_amd64
    steps:
      - uses: actions/checkout@v4
      - name: Setup OSV Scanner
        uses: your-username/osv-scanner-actions@main/setup-osv
        with:
          version: "v2.4.0"
          amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
          arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
      - name: Scan for vulnerabilities
        run: osv-scanner scan source -r .
```

## Inputs

| Input          | Description                                                          | Required | Default |
| -------------- | -------------------------------------------------------------------- | -------- | ------- |
| `version`      | Explicit osv-scanner release tag (e.g. `v2.4.0`). `latest` is rejected | Yes      | —       |
| `amd64-digest` | SHA-256 of `osv-scanner_linux_amd64` (hex or `sha256:<hex>`)         | Yes      | —       |
| `arm64-digest` | SHA-256 of `osv-scanner_linux_arm64` (hex or `sha256:<hex>`)         | Yes      | —       |