scan: bounded tool downloads, trivy-timeout input, no-images report fix

scan/action.yml

@@ -57,6 +57,9 @@ inputs:
     default: 'v0.27.2'
   osv-scanner-version:
     default: 'v2.7.0'
+  trivy-timeout:
+    description: 'Trivy scan timeout (large images can need more than 20m)'
+    default: '20m'
 
 runs:
   using: composite
@@ -78,9 +81,12 @@ runs:
       run: |
         set -euo pipefail
         d=~/.local/sbom-tools; mkdir -p "$d"
-        curl -sSfL "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" | sh -s -- -b "$d" "${TRIVY_VERSION}"
-        curl -sSfL "https://github.com/CycloneDX/cyclonedx-cli/releases/download/${CDX_VERSION}/cyclonedx-linux-x64" -o "$d/cyclonedx-cli"
-        curl -sSfL "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64" -o "$d/osv-scanner"
+        # Bounded downloads: a stalled transfer hung a run for 10+ minutes.
+        get() { curl -sSfL --connect-timeout 20 --max-time 300 --retry 3 --retry-all-errors "$@"; }
+        get "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" -o "$d/trivy-install.sh"
+        sh "$d/trivy-install.sh" -b "$d" "${TRIVY_VERSION}"; rm -f "$d/trivy-install.sh"
+        get "https://github.com/CycloneDX/cyclonedx-cli/releases/download/${CDX_VERSION}/cyclonedx-linux-x64" -o "$d/cyclonedx-cli"
+        get "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64" -o "$d/osv-scanner"
         chmod +x "$d"/*
 
     - name: Add tools to PATH
@@ -93,11 +99,12 @@ runs:
         SCAN_PATH: ${{ inputs.path }}
         CONTAINER_IMAGE: ${{ inputs.container-image }}
         CONTAINER_SKIP: ${{ inputs.container-skip-files }}
+        TRIVY_TIMEOUT: ${{ inputs.trivy-timeout }}
       run: |
         set -euo pipefail
-        trivy fs "$SCAN_PATH" --quiet --timeout 20m --format cyclonedx --output source-sbom.json
+        trivy fs "$SCAN_PATH" --quiet --timeout "$TRIVY_TIMEOUT" --format cyclonedx --output source-sbom.json
         if [ -n "$CONTAINER_IMAGE" ]; then
-          trivy image "$CONTAINER_IMAGE" --quiet --timeout 20m --skip-files "$CONTAINER_SKIP" \
+          trivy image "$CONTAINER_IMAGE" --quiet --timeout "$TRIVY_TIMEOUT" --skip-files "$CONTAINER_SKIP" \
             --format cyclonedx --output container-sbom.json
           cyclonedx-cli merge --input-files container-sbom.json source-sbom.json \
             --output-file sbom.json --output-format json
@@ -149,7 +156,7 @@ runs:
       run: |
         set -euo pipefail
         url=${PANEL_URL:-${DTRACK_URL%/}/panel-ci/report}
-        images=$(printf '%s' "$IMAGES" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' | jq -R . | jq -s .)
+        images=$(printf '%s' "$IMAGES" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | { grep -v '^$' || true; } | jq -R . | jq -s .)  # no images is fine
         tomls='[]'
         while IFS= read -r f; do
           tomls=$(jq --arg p "$f" --rawfile c "$f" '. + [{path: $p, content: $c}]' <<<"$tomls")