This is the workflow example

      - name: Manual Trivy Setup
        uses: aquasecurity/setup-trivy@v0.2.3
        with:
          cache: true
          version: v0.61.0
          path: .local/bin

      - name: Run Trivy vulnerability scanner in fs mode
        uses: aquasecurity/trivy-action@0.30.0
        with:
          scan-type: 'fs'
          scan-ref: 'btc/'
          trivy-config: trivy.yaml
          output: trivy.txt
          skip-setup-trivy: true
          version: v0.61.0
          cache: true
          cache-dir: .cache/trivy
        env:
          TRIVY_SKIP_DB_UPDATE: true
          TRIVY_SKIP_JAVA_DB_UPDATE: true

The problem come in when the trivy.yaml file have this key and the scan failed (has vulns)

exit-code: 1

Now if the job trivy-action failed. The cache key in the setup-trivy won't have any meaning, since the action is using actions/cache@v4 so it only perform caching when all job succeeded

I think the trivy binary should be saved in cache regardless of the result of the scanning. Hence, switch from action/cache to action/save and action/restore will solve the problem

Use save to cache trivy binary #18

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions