sec-actions/scan-config/README.md

Trivy scan (misconfiguration)

Composite action that runs trivy config inside Docker with the same hardening style as setup-db: read-only root filesystem, dropped capabilities, no-new-privileges, AppArmor docker-default, a private tmpfs on /tmp, and resource limits.

The directory you pass as scan-path is bind-mounted read-only at /scan. The vulnerability and policy cache from setup-db is mounted read-only at /cache. Your output-dir is mounted read-write at /out; the report is written as output-file inside that directory. The report format is always SARIF (--format sarif). Trivy is always run with --offline-scan (no API calls to resolve dependencies) and --exit-code 0 (the step succeeds after writing the report even when findings are present).

Misconfiguration scans do not need outbound network. This action sets --network none so the container cannot reach the network. Rego check bundles are not fetched online (--skip-check-update); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.

Bind mounts: Prefer cache-dir, output-dir, and scan-path under github.workspace (the default cache path does). Paths under runner.temp (e.g. /tmp/...) often work on GitHub-hosted runners but can break when the Docker daemon does not share that mount with the job.

Prerequisites

• Docker on the runner.
• A populated Trivy cache at cache-dir (typically from the setup-db action).

Usage

- uses: actions/checkout@v4
- name: Setup Trivy DB cache
  id: db
  uses: ./setup-db
- name: Misconfiguration scan
  id: scan
  uses: ./scan-config
  with:
    scan-path: ${{ github.workspace }}
    cache-dir: ${{ steps.db.outputs.cache-dir }}
    output-dir: ${{ github.workspace }}/trivy-reports
    output-file: misconfig.sarif
- name: Upload report
  uses: actions/upload-artifact@v4
  with:
    name: trivy-misconfig
    path: ${{ steps.scan.outputs.output-path }}

Inputs

Input	Description	Required	Default
scan-path	Host directory to scan (mounted read-only at /scan)	Yes	—
cache-dir	Trivy cache directory (mounted read-only at /cache; created if missing)	No	${{ github.workspace }}/.trivy-cache
output-dir	Host directory for the report (mounted read-write at /out; created if missing)	Yes	—
output-file	SARIF file name only (no /); created under output-dir	Yes	—
trivy-version	Trivy Docker image (digest pin recommended)	No	Same pin as setup-db / see action.yaml

trivy-version is optional. Omit it to use the default image from action.yaml.

Outputs

Output	Description
output-path	Absolute path to the SARIF report on the host

Notes

• cache-dir and output-dir are created with mkdir -p if missing (required for Docker bind mounts). scan-path must already exist.
• The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).