Setup OSV-Scanner Action

A reusable Gitea Action that downloads and sets up the OSV-Scanner binary for vulnerability scanning.

The release tag is always explicit (defaults are pinned to a specific version). Each download is verified with SHA256 against the expected digest for linux_amd64 or linux_arm64.

When you bump version, update sha256_linux_amd64 and sha256_linux_arm64 from the matching release asset osv-scanner_SHA256SUMS on GitHub.

Usage

- name: Setup OSV-Scanner
  uses: your-username/osv-scanner-actions@main/setup-osv-scanner
  with:
    version: "v2.3.3"
    # Optional: override defaults when you change version
    # sha256_linux_amd64: "..."
    # sha256_linux_arm64: "..."

Example workflow

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup OSV-Scanner
        uses: your-username/osv-scanner-actions@main/setup-osv-scanner
      - name: Scan
        run: osv-scanner scan source -r .

Inputs

Name	Description	Required	Default (for `v2.3.3`)
`version`	Git tag of the release to install	No	`v2.3.3`
`sha256_linux_amd64`	Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag	No	`777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033`
`sha256_linux_arm64`	Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag	No	`0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616`

Notes

Linux runners only (linux_amd64 / linux_arm64 release assets).
The binary is cached with actions/cache by version and architecture.
Downloads use curl -f so missing releases fail fast.