sec-actions/setup-osv-db/action.yaml

name: "Setup OSV offline vulnerability DB"
description: "Populate or restore the OSV-Scanner local vulnerability database cache (offline mode)"
author: "Timo Behrendt <t.behrendt@t00n.de>"
branding:
  icon: "database"
  color: "blue"

inputs:
  cache-dir:
    description: "Directory for OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{ runner.temp }}/osv-scanner)"
    required: false
    default: "${{ runner.temp }}/osv-scanner"
  cache-bucket-hours:
    description: "actions/cache key advances every this many full hours (UTC, since epoch). Example: 24 ≈ daily bucket; 1 = new key each hour."
    required: false
    default: "24"
  ecosystems:
    description: "Comma-separated ecosystem tokens (slug or official name, see README). OSV has no Docker Hub bucket; token `docker` installs the `Linux` ecosystem as a practical default for image-style data."
    required: false
    default: "github-actions,npm,go,docker"

outputs:
  cache-dir:
    description: "Path passed to OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY"
    value: ${{ inputs.cache-dir }}

runs:
  using: "composite"
  steps:
    - id: prepare
      shell: bash
      run: |
        set -euo pipefail

        slugify() {
          local s="$1"
          s=$(printf '%s' "$s" | tr '[:upper:]' '[:lower:]')
          s=$(printf '%s' "$s" | sed 's/\[//g;s/\]//g')
          s=$(printf '%s' "$s" | sed 's/[[:space:]]\+/-/g')
          printf '%s' "$s"
        }

        HOURS="${{ inputs.cache-bucket-hours }}"
        case "$HOURS" in
          ''|*[!0-9]*) echo "cache-bucket-hours must be a positive integer, got: $HOURS" >&2; exit 1 ;;
        esac
        if [ "$HOURS" -lt 1 ]; then
          echo "cache-bucket-hours must be >= 1" >&2
          exit 1
        fi
        bucket=$(( $(date -u +%s) / (3600 * HOURS) ))
        echo "hours=$HOURS" >> "$GITHUB_OUTPUT"
        echo "bucket=$bucket" >> "$GITHUB_OUTPUT"

        RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
        RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
        : > "$RESOLVED_FILE"

        ecosystems_all="$(mktemp)"
        curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt" -o "$ecosystems_all"

        declare -A SLUG_TO_OFFICIAL=()
        while IFS= read -r line || [ -n "$line" ]; do
          line="${line//$'\r'/}"
          [ -z "$line" ] && continue
          slug=$(slugify "$line")
          SLUG_TO_OFFICIAL["$slug"]="$line"
        done < "$ecosystems_all"
        rm -f "$ecosystems_all"

        declare -A SEEN_CANONICAL=()
        INPUT="${{ inputs.ecosystems }}"
        INPUT="${INPUT//$'\r'/}"
        if [ -z "${INPUT//[[:space:]]/}" ]; then
          echo "ecosystems input is empty" >&2
          exit 1
        fi

        IFS=',' read -ra PARTS <<< "$INPUT"
        for raw in "${PARTS[@]}"; do
          token=$(printf '%s' "$raw" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
          [ -z "$token" ] && continue
          tslug=$(slugify "$token")
          if [ "$tslug" = "docker" ]; then
            official="Linux"
          elif [ -n "${SLUG_TO_OFFICIAL[$tslug]+x}" ]; then
            official="${SLUG_TO_OFFICIAL[$tslug]}"
          else
            echo "Unknown ecosystem token: ${token}. Valid names/slugs match https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt (token docker -> Linux)." >&2
            exit 1
          fi
          if [ -z "${SEEN_CANONICAL[$official]+x}" ]; then
            SEEN_CANONICAL[$official]=1
            printf '%s\n' "$official" >> "$RESOLVED_FILE"
          fi
        done

        if [ ! -s "$RESOLVED_FILE" ]; then
          echo "No ecosystems resolved from input" >&2
          exit 1
        fi

        slug_keys=()
        while IFS= read -r official || [ -n "$official" ]; do
          [ -z "$official" ] && continue
          slug_keys+=("$(slugify "$official")")
        done < "$RESOLVED_FILE"
        ecosystems_key=$(printf '%s\n' "${slug_keys[@]}" | sort -u | paste -sd, -)
        echo "ecosystems-key=$ecosystems_key" >> "$GITHUB_OUTPUT"
    - id: restore-db
      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
      with:
        path: ${{ inputs.cache-dir }}
        key: osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-${{ steps.prepare.outputs.bucket }}
        restore-keys: |
          osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-
    - if: steps.restore-db.outputs.cache-hit != 'true'
      shell: bash
      run: |
        set -euo pipefail
        CACHE_DIR="${{ inputs.cache-dir }}"
        ROOT="${CACHE_DIR}/osv-scanner"
        BASE="https://osv-vulnerabilities.storage.googleapis.com"
        RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
        RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"

        rm -rf "$ROOT"
        mkdir -p "$ROOT"

        if [ ! -s "$RESOLVED_FILE" ]; then
          echo "Missing resolved ecosystem list at $RESOLVED_FILE" >&2
          exit 1
        fi

        while IFS= read -r ecosystem || [ -n "$ecosystem" ]; do
          [ -z "$ecosystem" ] && continue
          enc="$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$ecosystem")"
          dest_dir="${ROOT}/${ecosystem}"
          mkdir -p "$dest_dir"
          tmp="$(mktemp)"
          curl -fsSL "${BASE}/${enc}/all.zip" -o "$tmp"
          mv "$tmp" "${dest_dir}/all.zip"
        done < "$RESOLVED_FILE"