# Setup OSV-Scanner Action

A reusable Gitea Action that downloads and sets up the [OSV-Scanner](https://github.com/google/osv-scanner) binary for vulnerability scanning.

The release tag is **always explicit** (defaults are pinned to a specific version). Each download is verified with **SHA256** against the expected digest for `linux_amd64` or `linux_arm64`.

When you bump `version`, update `sha256_linux_amd64` and `sha256_linux_arm64` from the matching release asset `osv-scanner_SHA256SUMS` on GitHub.

## Usage

```yaml
- name: Setup OSV-Scanner
  uses: your-username/osv-scanner-actions@main/setup-osv-scanner
  with:
    version: "v2.3.3"
    # Optional: override defaults when you change version
    # sha256_linux_amd64: "..."
    # sha256_linux_arm64: "..."
```

## Example workflow

```yaml
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup OSV-Scanner
        uses: your-username/osv-scanner-actions@main/setup-osv-scanner
      - name: Scan
        run: osv-scanner scan source -r .
```

## Inputs

| Name                  | Description                                                                 | Required | Default (for `v2.3.3`) |
| --------------------- | --------------------------------------------------------------------------- | -------- | ------------------------ |
| `version`             | Git tag of the release to install                                           | No       | `v2.3.3`                 |
| `sha256_linux_amd64`  | Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag             | No       | `777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033` |
| `sha256_linux_arm64`  | Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag             | No       | `0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616` |

## Notes

- Linux runners only (`linux_amd64` / `linux_arm64` release assets).
- The binary is cached with `actions/cache` by version and architecture.
- Downloads use `curl -f` so missing releases fail fast.