Bump Trivy to v0.62.1

cbandy · cbandy · commit ffdf703b5001 · 2025-05-14T14:50:59.000-05:00
Document why the local action is still necessary. We have to update it ourselves periodically. See: https://github.com/aquasecurity/trivy/releases/tag/v0.62.1
diff --git a/.github/actions/awk-matcher.json b/.github/actions/awk-matcher.json
diff --git a/.github/actions/trivy/action.yaml b/.github/actions/trivy/action.yaml
@@ -1,39 +1,68 @@
+# Copyright 2024 - 2025 Crunchy Data Solutions, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# schema documentation: https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions
+# yaml-language-server: $schema=https://json.schemastore.org/github-action.json
+
 name: Trivy
 description: Scan this project using Trivy
 
 # The Trivy team maintains an action, but it has trouble caching its vulnerability data:
 # https://github.com/aquasecurity/trivy-action/issues/389
 #
+#  1. It caches vulnerability data once per calendar day, despite Trivy wanting
+#     to download more frequently than that.
+#  2. When it fails to download the data, it fails the workflow *and* caches
+#     the incomplete data.
+#  3. When (1) and (2) coincide, every following run that day *must* update the data,
+#     producing more opportunities for (2) and more failed workflows.
+#
 # The action below uses any recent cache matching `cache-prefix` and calculates a cache key
-# derived from the data Trivy downloads.
+# derived from the data Trivy downloads. An older database is better than no scans at all.
+# When a run successfully updates the data, that data is cached and available to other runs.
 
 inputs:
   cache:
     default: restore,success,use
     description: >-
       What Trivy data to cache; one or more of restore, save, success, or use.
+      The value "use" instructs Trivy to read and write to its cache.
+      The value "restore" loads the Trivy cache from GitHub.
+      The value "success" saves the Trivy cache to GitHub when Trivy succeeds.
+      The value "save" saves the Trivy cache to GitHub regardless of Trivy.
 
   database:
     default: update
     description: >-
       How Trivy should handle its data; one of update or skip.
+      The value "skip" fetches no Trivy data at all.
 
   setup:
-    default: v0.57.1,cache
+    default: v0.62.1,cache
     description: >-
       How to install Trivy; one or more of version, none, or cache.
+      The value "none" does not install Trivy at all.
 
   cache-directory:
     default: ${{ github.workspace }}/.cache/trivy
+    description: >-
+      Directory where Trivy should store its data
 
   cache-prefix:
     default: cache-trivy
+    description: >-
+      Name (key) where Trivy data should be stored in the GitHub cache
 
   scan-target:
     default: .
+    description: >-
+      What Trivy should scan
 
   scan-type:
-    default: filesystem
+    default: repository
+    description: >-
+      How Trivy should interpret scan-target; one of filesystem, image, repository, or sbom.
 
 runs:
   using: composite
@@ -50,9 +79,10 @@ runs:
             "setup=\(split("[,\\s]+"; "") - [""])",
             "version=\(split("[,\\s]+"; "") | max_by(split("[v.]"; "") | map(tonumber?)))"
           '
-        ) | tee --append $GITHUB_OUTPUT
+        ) | tee --append "${GITHUB_OUTPUT}"
 
     # Install Trivy as requested.
+    # NOTE: `setup-trivy` can download a "latest" version but cannot cache it.
     - if: ${{ ! contains(fromJSON(steps.parsed.outputs.setup), 'none') }}
       uses: aquasecurity/setup-trivy@v0.2.3
       with:
@@ -75,12 +105,13 @@ runs:
         TRIVY_SKIP_CHECK_UPDATE: ${{ inputs.database == 'skip' }}
         TRIVY_SKIP_DB_UPDATE: ${{ inputs.database == 'skip' }}
         TRIVY_SKIP_JAVA_DB_UPDATE: ${{ inputs.database == 'skip' }}
+        TRIVY_SKIP_VEX_REPO_UPDATE: ${{ inputs.database == 'skip' }}
       run: |
         # Run Trivy
         trivy '${{ inputs.scan-type }}' '${{ inputs.scan-target }}' || result=$?
 
         checksum=$([[ -z "${TRIVY_CACHE_DIR}" ]] || cat "${TRIVY_CACHE_DIR}/"*/metadata.json | sha256sum)
-        echo 'cache-key=${{ inputs.cache-prefix }}-'"${checksum%% *}" >> $GITHUB_OUTPUT
+        echo 'cache-key=${{ inputs.cache-prefix }}-'"${checksum%% *}" >> "${GITHUB_OUTPUT}"
 
         exit "${result-0}"
 
diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
@@ -29,6 +29,9 @@ jobs:
           TRIVY_DOWNLOAD_DB_ONLY: true
           TRIVY_NO_PROGRESS: true
           TRIVY_SCANNERS: license,secret,vuln
+        with:
+          cache: restore,success,use
+          database: update
 
   licenses:
     # Run this job after the cache job regardless of its success or failure.
