From e4a0cac9ff34320ff4f3cc06d3de40606dcd3871 Mon Sep 17 00:00:00 2001
From: Philipp Horstenkamp <philipp@horstenkamp.de>
Date: Sun, 13 Sep 2026 03:41:34 +0200
Subject: [PATCH] refactor: internalize trivy version management and remove
 input

---
 README.md     |  1 -
 action.yaml   | 21 +++++++++++----------
 renovate.json |  2 +-
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index cbafd96..39ef788 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,6 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
 | `head-image` | Head container image reference to scan (e.g. `registry.example.com/repo:git-sha`) | **Yes** | — |
 | `target-image` | Target baseline container image reference to compare against (e.g. `registry.example.com/repo:latest`) | **Yes** | — |
 | `target-branch` | Target branch name for report headings | No | `main` |
-| `trivy-version` | Trivy version to install and verify | No | `0.74.0` |
 | `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` |
 | `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` |
 | `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` |
diff --git a/action.yaml b/action.yaml
index b93fdf6..74e84a0 100644
--- a/action.yaml
+++ b/action.yaml
@@ -12,10 +12,6 @@ inputs:
     description: Target branch name for delta heading (e.g. main)
     required: false
     default: main
-  trivy-version:
-    description: Trivy binary version to install and verify
-    required: false
-    default: 0.74.0   # trivy-version
   output-delta:
     description: Output markdown file for CVE delta report
     required: false
@@ -40,10 +36,14 @@ outputs:
 runs:
   using: composite
   steps:
-  - name: Prepare Cache Keys
+  - name: Prepare Cache Keys and Environment
     id: vars
     shell: bash
-    run: echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
+    env:
+      TRIVY_VERSION: 0.74.0   # trivy-version
+    run: |
+      echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
+      echo "version=${TRIVY_VERSION}" >> "$GITHUB_OUTPUT"
 
   - name: Cache Trivy (Binary & Vulnerability DB)
     uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830     # v4.3.0
@@ -51,9 +51,9 @@ runs:
       path: |
         ~/.cache/trivy-bin
         ~/.cache/trivy
-      key: trivy-${{ inputs.trivy-version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.vars.outputs.date }}
+      key: trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.vars.outputs.date }}
       restore-keys: |
-        trivy-${{ inputs.trivy-version }}-${{ runner.os }}-${{ runner.arch }}-
+        trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-
 
   - name: Install and Verify Trivy
     shell: bash
@@ -67,14 +67,15 @@ runs:
         aarch64|arm64) T_ARCH="ARM64" ;;
         *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
       esac
-      tarball="trivy_${{ inputs.trivy-version }}_Linux-${T_ARCH}.tar.gz"
+
       checksums_file="${{ github.action_path }}/checksums.txt"
+      tarball="trivy_${{ steps.vars.outputs.version }}_Linux-${T_ARCH}.tar.gz"
 
       if [ -f "$HOME/.cache/trivy-bin/${tarball}" ] && (cd "$HOME/.cache/trivy-bin" && grep "  ${tarball}$" "$checksums_file" | sha256sum -c -); then
         echo "Cached Trivy archive verified against lockfile."
       else
         echo "Archive missing or checksum mismatch; downloading..."
-        curl -sfLO "https://github.com/aquasecurity/trivy/releases/download/v${{ inputs.trivy-version }}/${tarball}" --output-dir "$HOME/.cache/trivy-bin"
+        curl -sfLO "https://github.com/aquasecurity/trivy/releases/download/v${{ steps.vars.outputs.version }}/${tarball}" --output-dir "$HOME/.cache/trivy-bin"
         (cd "$HOME/.cache/trivy-bin" && grep "  ${tarball}$" "$checksums_file" | sha256sum -c -)
       fi
 
diff --git a/renovate.json b/renovate.json
index 4e9d111..bf7d5a0 100644
--- a/renovate.json
+++ b/renovate.json
@@ -10,7 +10,7 @@
         "^action\\.ya?ml$"
       ],
       "matchStrings": [
-        "default:\\s*(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\s*#\\s*trivy-version"
+        "TRIVY_VERSION:\\s*(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\s*#\\s*trivy-version"
       ],
       "depNameTemplate": "aquasecurity/trivy",
       "datasourceTemplate": "github-releases",