| Filename | Latest commit message | Latest commit date |
|---|---|---|
81e514348e* fix: remove literal ${{ runner.temp }} from action.yaml
GitHub evaluates all ${{ }} expressions in action.yaml, including inside
input descriptions where the `runner` context is unavailable. The literal
${{ runner.temp }} in the `path` description made the action fail to load
with "Unrecognized named-value: 'runner'", breaking every consumer of
v0.3.0 regardless of whether `path` was set.
Fixes #37
* test: add CI workflow exercising the action
Run the action on ubuntu/windows/macos (defaults, cache, custom path) and
assert that an invalid `path` is rejected. Actually using the action via
`uses: ./` catches load-time errors like #37 that static linters miss.
* test: use Trivy v0.71.0 in CI workflow
v0.68.2 has no release assets, so the install step 404s. v0.71.0 (the version
from #37) downloads correctly.
* test: add positive control to reject-invalid-path job
The job asserted only that the install step failed, so it stayed green even
when the action failed to load entirely (the #37 regression). Add a control
step that installs with a valid path and must succeed, so the job can only
pass when the action loads and then rejects the invalid paths.
|
||
| .github/workflows | ||
| action.yaml | ||
| LICENSE | ||
| README.md | ||
setup-trivy
Set up your GitHub Actions workflow with a specific version of Trivy
Usage
Install the latest Trivy version
# ...
steps:
- name: Install Trivy
uses: aquasecurity/setup-trivy@e07451d2e059ed86c2870430ea286b3a9e0bf241
Install a specific Trivy version
# ...
steps:
- name: Install Trivy
uses: aquasecurity/setup-trivy@e07451d2e059ed86c2870430ea286b3a9e0bf241
with:
version: v0.68.2
Caching
setup-trivy uses actions/cache under the hood but requires less configuration settings.
This caches the trivy binary so that next time you run, instead of downloading the binary it is loaded from the cache. This is not the same cache as other Trivy artifacts such as trivy-db and trivy-java-db.
The cache input is optional, and caching is turned off by default.
Caching is not supported for empty and latest versions!
Enable caching
If you want to enable caching for Linux and MacOS runners, set the cache input to true and specify the version.
steps:
- name: Install Trivy
uses: aquasecurity/setup-trivy@e07451d2e059ed86c2870430ea286b3a9e0bf241
with:
version: v0.68.2
cache: true
Custom path to Trivy binary
action/cache doesn't support absolute path for Windows runners (see here for more details).
To enable caching for Windows runner or if you need to change the Trivy installation directory for other reasons - use path input.
setup-trivy adds trivy-bin directory to avoid caching unnecessary files
steps:
- name: Install Trivy
uses: aquasecurity/setup-trivy@e07451d2e059ed86c2870430ea286b3a9e0bf241
with:
version: v0.68.2
cache: true
path: "./bins"
Important
pathmust be a literal path. Shell variables (e.g.$HOME,$RUNNER_TEMP) and~are not expanded and will fail the action. Use a GitHub expression that is resolved before the step runs instead, or a relative path like./bins.
Install Trivy with non-default token
There are cases when github.token (default value for actions/checkout) contains an invalid token for http://github.com.
One of example for this when using GitHub Enterprise Server (GHES).
See more info in https://github.com/aquasecurity/setup-trivy/issues/10
To properly install Trivy, you need to populate token from a secret or another step (e.g. from https://github.com/actions/create-github-app-token)
steps:
- name: Install Trivy
uses: aquasecurity/setup-trivy@e07451d2e059ed86c2870430ea286b3a9e0bf241
with:
version: v0.68.2
cache: true
token: ${{ secrets.GITHUB_PAT }}
Install Trivy with non-default github-server-url
In some cases, GHES deployments are isolated and don't use GitHub Connect. It uses the actions-sync process to mirror allowed actions into the GHES instance.
Set github-server-url to change the mirror of Trivy repository.
steps:
- name: Install Trivy
uses: aquasecurity/setup-trivy@e07451d2e059ed86c2870430ea286b3a9e0bf241
with:
version: v0.68.2
github-server-url: 'https://example.com'