t.behrendt
7d025410e7
CI / Test Merge SARIF Files (pull_request) Successful in 3s
CI / Test scan-image (pull_request) Failing after 5s
CI / Test scan-config (pull_request) Failing after 5s
CI / Test Setup DB (pull_request) Failing after 7s
CI / Test scan-fs (pull_request) Failing after 16s
CI / Test Get Images From Files (pull_request) Successful in 21s
60 lines
2.0 KiB
YAML
60 lines
2.0 KiB
YAML
name: "Setup Trivy DB"
|
|
description: "Setup the trivy database, restoring from cache if available"
|
|
author: "Timo Behrendt <t.behrendt@t00n.de"
|
|
branding:
|
|
icon: "database"
|
|
color: "blue"
|
|
|
|
inputs:
|
|
cache-dir:
|
|
description: "Path to the Trivy cache directory (default under github.workspace so Docker bind mounts work on typical runners)"
|
|
required: false
|
|
default: "${{ github.workspace }}/.trivy-cache"
|
|
trivy-version:
|
|
description: "Trivy docker image version to use (full image reference including digest is recommended)"
|
|
required: false
|
|
default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
|
|
|
|
outputs:
|
|
cache-dir:
|
|
description: "Path to the Trivy cache directory"
|
|
value: ${{ inputs.cache-dir }}
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- id: current-date
|
|
shell: bash
|
|
run: |
|
|
echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
|
|
- name: Ensure Trivy cache directory exists
|
|
shell: bash
|
|
run: mkdir -p "${{ inputs.cache-dir }}"
|
|
- id: restore-db
|
|
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
|
with:
|
|
path: ${{ inputs.cache-dir }}
|
|
key: trivy-db-${{ steps.current-date.outputs.current-date }}
|
|
restore-keys: |
|
|
trivy-db-${{ steps.current-date.outputs.current-date }}
|
|
- if: steps.restore-db.outputs.cache-hit != 'true'
|
|
shell: bash
|
|
run: |
|
|
docker run --rm \
|
|
--name trivy-db-download \
|
|
--user "$(id -u):$(id -g)" \
|
|
--read-only \
|
|
--env-file /dev/null \
|
|
--cap-drop ALL \
|
|
--pids-limit 64 \
|
|
--memory=512m \
|
|
--memory-swap=512m \
|
|
--cpus=1 \
|
|
--ipc private \
|
|
--cgroupns private \
|
|
--security-opt no-new-privileges \
|
|
--security-opt apparmor=docker-default \
|
|
--tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
|
|
--mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \
|
|
${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache
|