cve-differential/action.yaml

name: Trivy Multi-Arch CVE Delta Comparison
description: Downloads and verifies Trivy, extracts multi-platform SBOMs, and computes a consolidated set-based CVE delta report

inputs:
  head-image:
    description: Head container image reference (e.g. host/server/gitea:git-12345678)
    required: true
  target-image:
    description: Target baseline container image reference (e.g. host/server/gitea:latest)
    required: true
  target-branch:
    description: Target branch name for delta heading (e.g. main)
    required: false
    default: main
  architectures:
    description: Comma-separated list of architectures or platforms to scan (e.g. 'amd64,arm64' or 'linux/amd64,linux/arm64'). If empty, scans all architectures found in the container image.
    required: false
    default: ''
  output-delta:
    description: Output markdown file for CVE delta report
    required: false
    default: cve-delta.md
  output-summary:
    description: Output markdown file for full vulnerability summary
    required: false
    default: cve-summary.md
  write-summary:
    description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY)
    required: false
    default: 'true'
  use-inbuild-sbom:
    description: Whether to inspect and use built-in image SBOM attestations. If false (recommended default), generates SBOMs directly with Trivy for maximum vulnerability detection fidelity. If true, extracts attestations without pulling layers (faster, but findings may differ from direct scans due to binary vs source package tracking; falls back to Trivy image scan if 0 CVEs detected).
    required: false
    default: 'false'

outputs:
  delta-report:
    description: Path to CVE delta markdown report
    value: ${{ inputs.output-delta }}
  summary-report:
    description: Path to full vulnerability markdown report
    value: ${{ inputs.output-summary }}

runs:
  using: composite
  steps:
  - name: Prepare Cache Keys and Environment
    id: vars
    shell: bash
    env:
      TRIVY_VERSION: 0.74.0   # trivy-version
    run: |
      echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
      echo "version=${TRIVY_VERSION}" >> "$GITHUB_OUTPUT"

  - name: Cache Trivy (Binary & Vulnerability DB)
    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9     # v6.1.0
    with:
      path: |
        ~/.cache/trivy-bin
        ~/.cache/trivy
      key: trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.vars.outputs.date }}
      restore-keys: |
        trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-

  - name: Install and Verify Trivy
    shell: bash
    env:
      TRIVY_VERSION: ${{ steps.vars.outputs.version }}
    run: node "${{ github.action_path }}/lib/install-trivy.js"

  - name: Extract Multi-Platform SBOMs
    shell: bash
    env:
      PATH: ${{ env.HOME }}/.local/bin:${{ env.PATH }}
      TRIVY_SKIP_VERSION_CHECK: 'true'
      INPUT_HEAD_IMAGE: ${{ inputs.head-image }}
      INPUT_TARGET_IMAGE: ${{ inputs.target-image }}
      INPUT_ARCHITECTURES: ${{ inputs.architectures }}
      INPUT_USE_INBUILD_SBOM: ${{ inputs.use-inbuild-sbom }}
    run: node "${{ github.action_path }}/lib/extract-sboms.js"

  - name: Scan Multi-Platform SBOMs and Generate Delta
    shell: bash
    env:
      PATH: ${{ env.HOME }}/.local/bin:${{ env.PATH }}
      TRIVY_SKIP_VERSION_CHECK: 'true'
      INPUT_HEAD_IMAGE: ${{ inputs.head-image }}
      INPUT_TARGET_IMAGE: ${{ inputs.target-image }}
      INPUT_TARGET_BRANCH: ${{ inputs.target-branch }}
      INPUT_USE_INBUILD_SBOM: ${{ inputs.use-inbuild-sbom }}
      INPUT_OUTPUT_DELTA: ${{ inputs.output-delta }}
      INPUT_OUTPUT_SUMMARY: ${{ inputs.output-summary }}
    run: node "${{ github.action_path }}/lib/scan-sboms.js"

  - name: Publish Reports to Step Summary
    shell: bash
    run: |
      if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
        if [ -f "${{ inputs.output-delta }}" ]; then
          cat "${{ inputs.output-delta }}" >> "$GITHUB_STEP_SUMMARY"
        fi
        if [ -f "${{ inputs.output-summary }}" ]; then
          cat "${{ inputs.output-summary }}" >> "$GITHUB_STEP_SUMMARY"
        fi
      fi