sec-actions/setup-db

Setup DB Action

A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.

The action runs Trivy inside Docker with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.

The default cache-dir is under ${{ github.workspace }} so the path is visible to the Docker daemon when jobs run inside a container (bind-mounting e.g. /tmp/... often fails because that path does not exist on the Docker host).

Note: This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example trivy fs .), install Trivy separately (e.g. with a setup-trivy action or your own step).

Usage

Basic Usage

- name: Setup DB
  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1

Complete Example

name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on:
      - ubuntu-latest
      - linux_amd64
    steps:
      - uses: actions/checkout@v4
      - name: Setup Trivy
        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
      - name: Setup DB
        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
      - name: Scan for vulnerabilities
        run: trivy fs .

Inputs

Input	Description	Required	Default
cache-dir	Path to the Trivy cache directory	No	${{ github.workspace }}/.trivy-cache
trivy-version	Docker image reference for Trivy (digest pin recommended)	No	Pinned ghcr.io/aquasecurity/trivy image in action.yaml

trivy-version is optional. If you omit it, the action uses the default image (version and digest) from action.yaml. Set it only when you need a different Trivy image or your own digest pin.