Trivy Workflows

Run Trivy Scan (reusable workflow)

Reusable workflow that optionally runs Trivy config and/or image scan, merges the SARIF results, and exposes the merged file as an artifact. It does not upload to TAS; callers download the artifact and use it (e.g. with tas-upload-sarif).

Workflow file: ../.gitea/workflows/run-trivy-scan.yaml

Usage

Call from another workflow (same repo)

jobs:
  trivy:
    uses: ./.gitea/workflows/run-trivy-scan.yaml
    with:
      scan-config: true
      scan-images: true
      image-scan-files: |
        - k8s/31_deployment_redis.yaml
        - k8s/32_deployment_gitea.yaml
        - dockers/runner/compose.yaml
      trivy-server-url: ${{ vars.TRIVY_SERVER_URL }}
  use-sarif:
    needs: trivy
    runs-on: ubuntu-latest
    steps:
      - name: Download merged SARIF
        uses: https://github.com/ChristopherHX/gitea-download-artifact@v4
        with:
          name: ${{ needs.trivy.outputs.merged-sarif-artifact }}
          path: sarif
      # Path to file: sarif/${{ needs.trivy.outputs.merged-sarif-path }}
      # - uses: .../tas-upload-sarif@...
      #   with:
      #     sarif-file: sarif/${{ needs.trivy.outputs.merged-sarif-path }}

Call from another repository

Use the full workflow path including .gitea/workflows/ and the filename. Gitea does not accept a bare repo path like .../trivy-actions/run-trivy-scan@ref.

With absolute URL:

jobs:
  trivy:
    uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/.gitea/workflows/run-trivy-scan.yaml@1.4.5
    with:
      ref: 1.4.5   # use same ref as in 'uses' so actions load from trivy-actions
      scan-config: true
      scan-images: true
      image-scan-files: |
        - k8s/31_deployment_redis.yaml
      trivy-server-url: ${{ vars.TRIVY_SERVER_URL }}

With owner/repo path (same server as the caller):

jobs:
  trivy:
    uses: t.behrendt/trivy-actions/.gitea/workflows/run-trivy-scan.yaml@1.4.5
    with:
      ref: 1.4.5   # use same ref as in 'uses'
      scan-config: true
      scan-images: true
      image-scan-files: |
        - k8s/31_deployment_redis.yaml

When calling from another repo, pass ref with the same ref as in the workflow path (e.g. @1.4.5 or commit SHA). The workflow checks out trivy-actions at that ref into trivy-actions/ and then uses the actions from that checkout (e.g. ./trivy-actions/setup-trivy).

Inputs

Input	Type	Default	Description
scan-config	boolean	false	Run Trivy config scan on the repository root.
scan-images	boolean	false	Run Trivy image scan on images from image-scan-files.
image-scan-files	string	""	YAML list of files to extract container images from.
trivy-server-url	string	""	Optional Trivy server URL for image scan.
ref	string	"main"	Git ref to checkout (branch, tag, or SHA); use the same ref as in the workflow path when calling from another repo.
repository-url	string	"https://gitea.t000-n.de/t.behrendt/trivy-actions.git"	Clone URL for trivy-actions; for private repos use a URL with token or SSH.

At least one of scan-config or scan-images must be true. If scan-images is true, set image-scan-files.

Outputs

Output	Description
merged-sarif-artifact	Artifact name to pass to download-artifact (e.g. merged-sarif).
merged-sarif-path	Path to the file inside that artifact (e.g. merged-sarif.json).

After downloading the artifact, the merged SARIF file is at <download-path>/${{ needs.<job>.outputs.merged-sarif-path }}.