refactor: internalize trivy version management and remove input

action.yaml

@@ -12,10 +12,6 @@ inputs:
     description: Target branch name for delta heading (e.g. main)
     required: false
     default: main
-  trivy-version:
-    description: Trivy binary version to install and verify
-    required: false
-    default: 0.74.0   # trivy-version
   output-delta:
     description: Output markdown file for CVE delta report
     required: false
@@ -40,10 +36,14 @@ outputs:
 runs:
   using: composite
   steps:
-  - name: Prepare Cache Keys
+  - name: Prepare Cache Keys and Environment
     id: vars
     shell: bash
-    run: echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
+    env:
+      TRIVY_VERSION: 0.74.0   # trivy-version
+    run: |
+      echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
+      echo "version=${TRIVY_VERSION}" >> "$GITHUB_OUTPUT"
 
   - name: Cache Trivy (Binary & Vulnerability DB)
     uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830     # v4.3.0
@@ -51,9 +51,9 @@ runs:
       path: |
         ~/.cache/trivy-bin
         ~/.cache/trivy
-      key: trivy-${{ inputs.trivy-version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.vars.outputs.date }}
+      key: trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.vars.outputs.date }}
       restore-keys: |
-        trivy-${{ inputs.trivy-version }}-${{ runner.os }}-${{ runner.arch }}-
+        trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-
 
   - name: Install and Verify Trivy
     shell: bash
@@ -67,14 +67,15 @@ runs:
         aarch64|arm64) T_ARCH="ARM64" ;;
         *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
       esac
-      tarball="trivy_${{ inputs.trivy-version }}_Linux-${T_ARCH}.tar.gz"
+
       checksums_file="${{ github.action_path }}/checksums.txt"
+      tarball="trivy_${{ steps.vars.outputs.version }}_Linux-${T_ARCH}.tar.gz"
 
       if [ -f "$HOME/.cache/trivy-bin/${tarball}" ] && (cd "$HOME/.cache/trivy-bin" && grep "  ${tarball}$" "$checksums_file" | sha256sum -c -); then
         echo "Cached Trivy archive verified against lockfile."
       else
         echo "Archive missing or checksum mismatch; downloading..."
-        curl -sfLO "https://github.com/aquasecurity/trivy/releases/download/v${{ inputs.trivy-version }}/${tarball}" --output-dir "$HOME/.cache/trivy-bin"
+        curl -sfLO "https://github.com/aquasecurity/trivy/releases/download/v${{ steps.vars.outputs.version }}/${tarball}" --output-dir "$HOME/.cache/trivy-bin"
         (cd "$HOME/.cache/trivy-bin" && grep "  ${tarball}$" "$checksums_file" | sha256sum -c -)
       fi