48 lines
2.0 KiB
Markdown
48 lines
2.0 KiB
Markdown
# Setup OSV-Scanner Action
|
|
|
|
A reusable Gitea Action that downloads and sets up the [OSV-Scanner](https://github.com/google/osv-scanner) binary for vulnerability scanning.
|
|
|
|
The release tag is **always explicit** (defaults are pinned to a specific version). Each download is verified with **SHA256** against the expected digest for `linux_amd64` or `linux_arm64`.
|
|
|
|
When you bump `version`, update `sha256_linux_amd64` and `sha256_linux_arm64` from the matching release asset `osv-scanner_SHA256SUMS` on GitHub.
|
|
|
|
## Usage
|
|
|
|
```yaml
|
|
- name: Setup OSV-Scanner
|
|
uses: your-username/osv-scanner-actions@main/setup-osv-scanner
|
|
with:
|
|
version: "v2.3.3"
|
|
# Optional: override defaults when you change version
|
|
# sha256_linux_amd64: "..."
|
|
# sha256_linux_arm64: "..."
|
|
```
|
|
|
|
## Example workflow
|
|
|
|
```yaml
|
|
jobs:
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Setup OSV-Scanner
|
|
uses: your-username/osv-scanner-actions@main/setup-osv-scanner
|
|
- name: Scan
|
|
run: osv-scanner scan source -r .
|
|
```
|
|
|
|
## Inputs
|
|
|
|
| Name | Description | Required | Default (for `v2.3.3`) |
|
|
| --------------------- | --------------------------------------------------------------------------- | -------- | ------------------------ |
|
|
| `version` | Git tag of the release to install | No | `v2.3.3` |
|
|
| `sha256_linux_amd64` | Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag | No | `777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033` |
|
|
| `sha256_linux_arm64` | Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag | No | `0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616` |
|
|
|
|
## Notes
|
|
|
|
- Linux runners only (`linux_amd64` / `linux_arm64` release assets).
|
|
- The binary is cached with `actions/cache` by version and architecture.
|
|
- Downloads use `curl -f` so missing releases fail fast.
|