sec-actions/scan-fs

Trivy scan (filesystem)

Composite action that runs trivy filesystem inside Docker with the same hardening style as setup-db: read-only root filesystem, dropped capabilities, no-new-privileges, AppArmor docker-default, a private tmpfs on /tmp, and resource limits.

The directory you pass as scan-path is bind-mounted read-only at /scan. The Trivy cache from setup-db is mounted read-only at /cache. Your output-dir is mounted read-write at /out; the report is written as output-file inside that directory. The report format is always SARIF (--format sarif). Trivy is always run with --offline-scan (no API calls to identify dependencies) and --exit-code 0 (the step succeeds after writing the report even when findings are present).

Filesystem scans use --network none so the scan container cannot reach the network. The vulnerability database must already be present under cache-dir; the action passes --skip-db-update and --skip-check-update so Trivy does not try to refresh data online.

Prerequisites

• Docker on the runner.
• A populated Trivy cache at cache-dir (typically from the setup-db action).

Usage

- uses: actions/checkout@v4
- name: Setup Trivy DB cache
  id: db
  uses: ./setup-db
- name: Filesystem scan
  id: scan
  uses: ./scan-fs
  with:
    scan-path: ${{ github.workspace }}
    cache-dir: ${{ steps.db.outputs.cache-dir }}
    output-dir: ${{ github.workspace }}/trivy-reports
    output-file: fs.sarif
- name: Upload report
  uses: actions/upload-artifact@v4
  with:
    name: trivy-fs
    path: ${{ steps.scan.outputs.output-path }}

Inputs

Input	Description	Required	Default
scan-path	Host directory to scan (mounted read-only at /scan)	Yes	—
cache-dir	Trivy cache directory (mounted read-only at /cache)	No	${{ github.workspace }}/.trivy-cache
output-dir	Host directory for the report (mounted read-write at /out)	Yes	—
output-file	SARIF file name only (no /); created under output-dir	Yes	—
trivy-version	Trivy Docker image (digest pin recommended)	No	Same pin as setup-db / see action.yaml

trivy-version is optional. Omit it to use the default image from action.yaml.

Outputs

Output	Description
output-path	Absolute path to the SARIF report on the host

Notes

• Use cache-dir and output-dir under ${{ github.workspace }} (or another path the Docker daemon can bind-mount) when the job runs in a container.
• Paths should exist or be creatable: output-dir and cache-dir are created with mkdir -p if missing; scan-path must already exist as a directory.
• Default Trivy filesystem scanners include vuln and secret; misconfig-related network fetches are avoided via --skip-check-update.
• The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).