t.behrendt
7d025410e7
CI / Test Merge SARIF Files (pull_request) Successful in 3s
CI / Test scan-image (pull_request) Failing after 5s
CI / Test scan-config (pull_request) Failing after 5s
CI / Test Setup DB (pull_request) Failing after 7s
CI / Test scan-fs (pull_request) Failing after 16s
CI / Test Get Images From Files (pull_request) Successful in 21s
49 lines
2.4 KiB
Markdown
49 lines
2.4 KiB
Markdown
# Setup DB Action
|
|
|
|
A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
|
|
|
|
The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
|
|
|
|
**Bind mounts and paths:** The default **`cache-dir`** is under **`github.workspace`** (`.trivy-cache`), not `${{ runner.temp }}`, because on many self-hosted or containerized runners the Docker daemon does **not** see the same filesystem as the job for `/tmp`—bind mounts then fail with “source path does not exist” even though the shell created the directory. If you set **`cache-dir`** yourself, use a path the Docker daemon can access (typically under the checked-out workspace).
|
|
|
|
**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
|
|
|
|
## Usage
|
|
|
|
### Basic Usage
|
|
|
|
```yaml
|
|
- name: Setup DB
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
|
|
```
|
|
|
|
### Complete Example
|
|
|
|
```yaml
|
|
name: Security Scan
|
|
on: [push, pull_request]
|
|
|
|
jobs:
|
|
security:
|
|
runs-on:
|
|
- ubuntu-latest
|
|
- linux_amd64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Setup Trivy
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
|
|
- name: Setup DB
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
|
|
- name: Scan for vulnerabilities
|
|
run: trivy fs .
|
|
```
|
|
|
|
## Inputs
|
|
|
|
| Input | Description | Required | Default |
|
|
| --------------- | --------------------------------------------------------- | -------- | ---------------------------------------------------------- |
|
|
| `cache-dir` | Path to the Trivy cache directory | No | `${{ github.workspace }}/.trivy-cache` |
|
|
| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
|
|
|
|
**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.
|