Initial composite action: install Trivy + CycloneDX with caching

2026-05-11 15:47:45 +03:00
commit 5c723611b1
2 changed files with 74 additions and 0 deletions
@@ -0,0 +1,31 @@
+# sbom-tools-action
+
+Composite action that installs Trivy and the CycloneDX CLI with caching, ready for SBOM generation workflows.
+
+## Why
+
+The previous setup pinned `TRIVY_VERSION` and `CYCLONEDX_CLI_VERSION` in every consuming workflow. When the upstream `trivy/contrib/install.sh` started failing for older release-asset layouts, every repo needed a PR to bump. This action centralises the install logic and reads versions as inputs (typically wired to the gitea instance variables `vars.TRIVY_VERSION` / `vars.CYCLONEDX_CLI_VERSION`).
+
+## Usage
+
+```yaml
+- uses: https://git.janhouse.lv/janhouse/sbom-tools-action@v1
+  with:
+    trivy-version: ${{ vars.TRIVY_VERSION }}
+    cyclonedx-version: ${{ vars.CYCLONEDX_CLI_VERSION }}
+```
+
+After this step, `trivy` and `cyclonedx-cli` are on `PATH`. Cache is keyed on the runner OS + both versions, so a bump invalidates and reinstalls automatically.
+
+## Inputs
+
+| Name | Description | Required |
+| --- | --- | --- |
+| `trivy-version` | Trivy release tag, e.g. `v0.70.0`. | yes |
+| `cyclonedx-version` | CycloneDX CLI release tag, e.g. `v0.27.1`. | yes |
+
+Both inputs are required so the consumer is explicit about source. Wire them to gitea instance vars to avoid hardcoding.
+
+## Versioning
+
+The repo follows lightweight tags: `v1`, `v1.0.0`, etc. Consumers pin to `@v1` for in-major updates, or `@<sha>` for full pinning.