t.behrendt
954681c5af
CI / Test Merge SARIF Files (pull_request) Successful in 4s
CI / Test Setup DB (pull_request) Successful in 6s
CI / Test Get Images From Files (pull_request) Successful in 5s
CI / Test scan-image (pull_request) Failing after 6s
CI / Test scan-fs (pull_request) Failing after 1m14s
CI / Test scan-config (pull_request) Failing after 1m2s
49 lines
2.5 KiB
Markdown
49 lines
2.5 KiB
Markdown
# Setup DB Action
|
|
|
|
A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
|
|
|
|
The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
|
|
|
|
**Docker-in-Docker:** If the job runs **in a container** and talks to a **DinD sidecar**, bind-mount sources must live on the volume **both** the job and the Docker daemon see. On GitHub-hosted-style setups that is typically under **`RUNNER_TEMP`** (e.g. `/home/runner/_work/_temp`). The default **`cache-dir`** is **`${{ runner.temp }}/trivy`** for that reason—see [this overview of DinD bind mounts](https://dev.to/devactivity/navigating-github-actions-dind-bind-mounts-insights-from-recent-github-reports-for-cicd-1c8). Configure your Gitea runner the same way, or set **`cache-dir`** to a path your platform documents as shared with DinD.
|
|
|
|
**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
|
|
|
|
## Usage
|
|
|
|
### Basic Usage
|
|
|
|
```yaml
|
|
- name: Setup DB
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
|
|
```
|
|
|
|
### Complete Example
|
|
|
|
```yaml
|
|
name: Security Scan
|
|
on: [push, pull_request]
|
|
|
|
jobs:
|
|
security:
|
|
runs-on:
|
|
- ubuntu-latest
|
|
- linux_amd64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Setup Trivy
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
|
|
- name: Setup DB
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
|
|
- name: Scan for vulnerabilities
|
|
run: trivy fs .
|
|
```
|
|
|
|
## Inputs
|
|
|
|
| Input | Description | Required | Default |
|
|
| ---------------- | --------------------------------------------------------------------------- | -------- | ------- |
|
|
| `cache-dir` | Trivy cache directory (created if missing; bind-mounted for DB download) | No | `${{ runner.temp }}/trivy` |
|
|
| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
|
|
|
|
**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.
|