sec-actions/setup-osv-scanner/README.md

Setup OSV-Scanner Action

A reusable Gitea Action that downloads and sets up the OSV-Scanner binary for vulnerability scanning.

The release tag is always explicit (defaults are pinned to a specific version). Each download is verified with SHA256 against the expected digest for linux_amd64 or linux_arm64.

When you bump version, update sha256_linux_amd64 and sha256_linux_arm64 from the matching release asset osv-scanner_SHA256SUMS on GitHub.

Usage

- name: Setup OSV-Scanner
  uses: your-username/osv-scanner-actions@main/setup-osv-scanner
  with:
    version: "v2.3.3"
    # Optional: override defaults when you change version
    # sha256_linux_amd64: "..."
    # sha256_linux_arm64: "..."

Example workflow

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup OSV-Scanner
        uses: your-username/osv-scanner-actions@main/setup-osv-scanner
      - name: Scan
        run: osv-scanner scan source -r .

Inputs

Name	Description	Required	Default (for v2.3.3)
version	Git tag of the release to install	No	v2.3.3
sha256_linux_amd64	Expected SHA256 (hex) of osv-scanner_linux_amd64 for that tag	No	777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033
sha256_linux_arm64	Expected SHA256 (hex) of osv-scanner_linux_arm64 for that tag	No	0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616

Notes

• Linux runners only (linux_amd64 / linux_arm64 release assets).
• The binary is cached with actions/cache by version and architecture.
• Downloads use curl -f so missing releases fail fast.