t.behrendt
368e1be8dd
CD / Release (push) Successful in 3s
Reviewed-on: #51 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
52 lines
1.9 KiB
Markdown
52 lines
1.9 KiB
Markdown
# Setup OSV Scanner Action
|
|
|
|
A reusable Gitea Action that downloads and sets up the osv-scanner binary for vulnerability scanning.
|
|
|
|
The downloaded binary is verified against a pinned SHA-256 digest for the runner architecture.
|
|
|
|
## Usage
|
|
|
|
### Basic Usage
|
|
|
|
```yaml
|
|
- name: Setup OSV Scanner
|
|
uses: your-username/osv-scanner-actions@main/setup-osv
|
|
with:
|
|
version: "v2.4.0"
|
|
amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
|
|
arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
|
|
```
|
|
|
|
Digests are published in each release's `osv-scanner_SHA256SUMS` file (e.g. for `osv-scanner_linux_amd64` / `osv-scanner_linux_arm64`). You may pass either bare hex or `sha256:<hex>`.
|
|
|
|
### Complete Example
|
|
|
|
```yaml
|
|
name: Security Scan
|
|
on: [push, pull_request]
|
|
|
|
jobs:
|
|
security:
|
|
runs-on:
|
|
- ubuntu-latest
|
|
- linux_amd64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Setup OSV Scanner
|
|
uses: your-username/osv-scanner-actions@main/setup-osv
|
|
with:
|
|
version: "v2.4.0"
|
|
amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
|
|
arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
|
|
- name: Scan for vulnerabilities
|
|
run: osv-scanner scan source -r .
|
|
```
|
|
|
|
## Inputs
|
|
|
|
| Input | Description | Required | Default |
|
|
| -------------- | -------------------------------------------------------------------- | -------- | ------- |
|
|
| `version` | Explicit osv-scanner release tag (e.g. `v2.4.0`). `latest` is rejected | Yes | — |
|
|
| `amd64-digest` | SHA-256 of `osv-scanner_linux_amd64` (hex or `sha256:<hex>`) | Yes | — |
|
|
| `arm64-digest` | SHA-256 of `osv-scanner_linux_arm64` (hex or `sha256:<hex>`) | Yes | — |
|