# Trivy scan (filesystem)

Composite action that runs **`trivy filesystem`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.

The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).

**Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.

## Prerequisites

- Docker on the runner.
- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).

## Usage

```yaml
- uses: actions/checkout@v4
- name: Setup Trivy DB cache
  id: db
  uses: ./setup-db
- name: Filesystem scan
  id: scan
  uses: ./scan-fs
  with:
    scan-path: ${{ github.workspace }}
    cache-dir: ${{ steps.db.outputs.cache-dir }}
    output-dir: ${{ runner.temp }}/trivy-reports
    output-file: fs.sarif
- name: Upload report
  uses: actions/upload-artifact@v4
  with:
    name: trivy-fs
    path: ${{ steps.scan.outputs.output-path }}
```

## Inputs

| Input           | Description                                                                 | Required | Default |
| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
| `scan-path`     | Host directory to scan (mounted read-only at `/scan`)                       | Yes      | —       |
| `cache-dir`     | Trivy cache directory (mounted read-only at `/cache`)                       | No       | `${{ runner.temp }}/trivy` |
| `output-dir`    | Host directory for the report (mounted read-write at `/out`)                | Yes      | —       |
| `output-file`   | SARIF file name only (no `/`); created under `output-dir`                   | Yes      | —       |
| `trivy-version` | Trivy Docker image (digest pin recommended)                                 | No       | Same pin as `setup-db` / see `action.yaml` |

**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.

## Outputs

| Output         | Description                          |
| -------------- | ------------------------------------ |
| `output-path`  | Absolute path to the SARIF report on the host |

## Notes

- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
- Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).