From ec5a49826693d9334def504bc8122b68901372e5 Mon Sep 17 00:00:00 2001 From: peet Date: Sat, 29 Aug 2026 09:39:49 +0200 Subject: [PATCH] Use docker-archive for the Trivy scan export (oci-archive unsupported) Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg --- podman-build-publish/action.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/podman-build-publish/action.yaml b/podman-build-publish/action.yaml index b8b1b76..bd2063e 100644 --- a/podman-build-publish/action.yaml +++ b/podman-build-publish/action.yaml @@ -178,10 +178,11 @@ runs: first_tag="$(printf '%s\n' "${{ inputs.tags }}" | tr ', ' '\n\n' | sed '/^$/d' | head -n1)" # Trivy cannot read podman's storage under a custom --root, so scan - # an exported archive of the image instead. + # an exported archive instead. Must be docker-archive: trivy's + # --input does not understand oci-archive tarballs (verified). archive="${RUNNER_TEMP}/trivy-scan-image.tar" rm -f "${archive}" - podman "${podman_args[@]}" save --format oci-archive -o "${archive}" "${image_base}:${first_tag}" + podman "${podman_args[@]}" save --format docker-archive -o "${archive}" "${image_base}:${first_tag}" echo "Scanning ${image_base}:${first_tag} (fail on: ${{ inputs.scan-severity }}, fixed only)" trivy image \