Composite action that runs trivy config inside Docker with the same hardening style as setup-db: read-only root filesystem, dropped capabilities, no-new-privileges, AppArmor docker-default, a private tmpfs on /tmp, and resource limits.

The directory you pass as scan-path is bind-mounted read-only at /scan. The vulnerability and policy cache from setup-db is mounted read-only at /cache. Your output-dir is mounted read-write at /out; the report is written as output-file inside that directory. The report format is always SARIF (--format sarif). Trivy is always run with --offline-scan (no API calls to resolve dependencies) and --exit-code 0 (the step succeeds after writing the report even when findings are present).

Misconfiguration scans do not need outbound network. This action sets --network none so the container cannot reach the network. Rego check bundles are not fetched online (--skip-check-update); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.

Prerequisites

Docker on the runner.
A populated Trivy cache at cache-dir (typically from the setup-db action).

Usage

- uses: actions/checkout@v4
- name: Setup Trivy DB cache
  id: db
  uses: ./setup-db
- name: Misconfiguration scan
  id: scan
  uses: ./scan-config
  with:
    scan-path: ${{ github.workspace }}
    cache-dir: ${{ steps.db.outputs.cache-dir }}
    output-dir: ${{ runner.temp }}/trivy-reports
    output-file: misconfig.sarif
- name: Upload report
  uses: actions/upload-artifact@v4
  with:
    name: trivy-misconfig
    path: ${{ steps.scan.outputs.output-path }}

Inputs

Input	Description	Required	Default
`scan-path`	Host directory to scan (mounted read-only at `/scan`)	Yes	—
`cache-dir`	Trivy cache directory (mounted read-only at `/cache`)	No	`${{ runner.temp }}/trivy`
`output-dir`	Host directory for the report (mounted read-write at `/out`)	Yes	—
`output-file`	SARIF file name only (no `/`); created under `output-dir`	Yes	—
`trivy-version`	Trivy Docker image (digest pin recommended)	No	Same pin as `setup-db` / see `action.yaml`

trivy-version is optional. Omit it to use the default image from action.yaml.

Outputs

Output	Description
`output-path`	Absolute path to the SARIF report on the host

Notes

Paths should exist or be creatable: output-dir is created with mkdir -p if missing; scan-path and cache-dir must already exist.
The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).