name: "Setup Trivy"
description: "Download and setup Trivy binary for vulnerability scanning"
author: "Gitea Actions"
branding:
  icon: "shield"
  color: "blue"

inputs:
  version:
    description: "Trivy version to download (e.g., latest)"
    required: false
    default: "v0.66.0"

runs:
  using: "composite"
  steps:
    - name: Cache Trivy binary
      id: cache-trivy
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
      with:
        path: /usr/local/bin/trivy
        key: trivy-${{ inputs.version }}-${{ inputs.architecture }}
        restore-keys: |
          trivy-${{ inputs.version }}-${{ inputs.architecture }}-
          trivy-${{ inputs.version }}-

    - shell: bash
      run: |
        set -e
        case "$(uname -m)" in
          x86_64)
            ARCH="64bit"
            ;;
          aarch64)
            ARCH="ARM64"
            ;;
        esac
        echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
    - name: Download and install Trivy
      if: steps.cache-trivy.outputs.cache-hit != 'true'
      shell: bash
      run: |
        set -e

        VERSION="${{ inputs.version }}"

        mkdir -p /usr/local/bin

        curl -sL "https://github.com/aquasecurity/trivy/releases/download/${VERSION}/trivy_${VERSION#v}_Linux-${ARCH}.tar.gz" -o trivy.tar.gz
        tar -xzf trivy.tar.gz
        chmod +x trivy
        mv trivy /usr/local/bin/
        rm trivy.tar.gz

    - name: Add Trivy to PATH
      shell: bash
      run: |
        echo "/usr/local/bin" >> $GITHUB_PATH