refactor: internalize trivy version management and remove input

README.md

@@ -24,7 +24,6 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
 | `head-image` | Head container image reference to scan (e.g. `registry.example.com/repo:git-sha`) | **Yes** | — |
 | `target-image` | Target baseline container image reference to compare against (e.g. `registry.example.com/repo:latest`) | **Yes** | — |
 | `target-branch` | Target branch name for report headings | No | `main` |
-| `trivy-version` | Trivy version to install and verify | No | `0.74.0` |
 | `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` |
 | `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` |
 | `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` |

action.yaml

@@ -12,10 +12,6 @@ inputs:
     description: Target branch name for delta heading (e.g. main)
     required: false
     default: main
-  trivy-version:
-    description: Trivy binary version to install and verify
-    required: false
-    default: 0.74.0   # trivy-version
   output-delta:
     description: Output markdown file for CVE delta report
     required: false
@@ -40,10 +36,14 @@ outputs:
 runs:
   using: composite
   steps:
-  - name: Prepare Cache Keys
+  - name: Prepare Cache Keys and Environment
     id: vars
     shell: bash
-    run: echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
+    env:
+      TRIVY_VERSION: 0.74.0   # trivy-version
+    run: |
+      echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
+      echo "version=${TRIVY_VERSION}" >> "$GITHUB_OUTPUT"
 
   - name: Cache Trivy (Binary & Vulnerability DB)
     uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830     # v4.3.0
@@ -51,9 +51,9 @@ runs:
       path: |
         ~/.cache/trivy-bin
         ~/.cache/trivy
-      key: trivy-${{ inputs.trivy-version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.vars.outputs.date }}
+      key: trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.vars.outputs.date }}
       restore-keys: |
-        trivy-${{ inputs.trivy-version }}-${{ runner.os }}-${{ runner.arch }}-
+        trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-
 
   - name: Install and Verify Trivy
     shell: bash
@@ -67,14 +67,15 @@ runs:
         aarch64|arm64) T_ARCH="ARM64" ;;
         *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
       esac
-      tarball="trivy_${{ inputs.trivy-version }}_Linux-${T_ARCH}.tar.gz"
+
       checksums_file="${{ github.action_path }}/checksums.txt"
+      tarball="trivy_${{ steps.vars.outputs.version }}_Linux-${T_ARCH}.tar.gz"
 
       if [ -f "$HOME/.cache/trivy-bin/${tarball}" ] && (cd "$HOME/.cache/trivy-bin" && grep "  ${tarball}$" "$checksums_file" | sha256sum -c -); then
         echo "Cached Trivy archive verified against lockfile."
       else
         echo "Archive missing or checksum mismatch; downloading..."
-        curl -sfLO "https://github.com/aquasecurity/trivy/releases/download/v${{ inputs.trivy-version }}/${tarball}" --output-dir "$HOME/.cache/trivy-bin"
+        curl -sfLO "https://github.com/aquasecurity/trivy/releases/download/v${{ steps.vars.outputs.version }}/${tarball}" --output-dir "$HOME/.cache/trivy-bin"
         (cd "$HOME/.cache/trivy-bin" && grep "  ${tarball}$" "$checksums_file" | sha256sum -c -)
       fi
 

renovate.json

@@ -10,7 +10,7 @@
         "^action\\.ya?ml$"
       ],
       "matchStrings": [
-        "default:\\s*(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\s*#\\s*trivy-version"
+        "TRIVY_VERSION:\\s*(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\s*#\\s*trivy-version"
       ],
       "depNameTemplate": "aquasecurity/trivy",
       "datasourceTemplate": "github-releases",