name: Trivy Filesystem Scan
description: >
  Scan the checked-out workspace for vulnerable dependencies (lockfile-based:
  gradle.lockfile, package-lock.json, etc.) with Trivy. For repos that build
  artifacts rather than container images. Requires the trivy binary on the
  runner (noctrl/gitea-runner >= v9) — pin the job to linux,build,amd64.
  Gradle projects must have dependency locking enabled with committed
  lockfiles, or trivy has nothing to read.

inputs:
  path:
    description: Directory to scan.
    required: false
    default: "."
  severity:
    description: Comma-separated Trivy severities to report.
    required: false
    default: HIGH,CRITICAL
  enforce:
    description: >
      "true" (the default) fails the job on findings with an available fix.
      Set "false" ONLY as a temporary emergency escape (e.g. an urgent fix
      must ship while a finding is being addressed) — always with an inline
      comment in the workflow explaining why.
    required: false
    default: "true"

runs:
  using: composite
  steps:
    - id: scan
      shell: bash
      run: |
        set -euo pipefail

        if ! command -v trivy >/dev/null 2>&1; then
          echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
          exit 1
        fi

        exit_code=0
        if [[ "${{ inputs.enforce }}" == "true" ]]; then
          exit_code=1
        fi

        echo "Scanning ${{ inputs.path }} (severities: ${{ inputs.severity }}, enforce: ${{ inputs.enforce }})"
        trivy fs \
          --scanners vuln \
          --severity "${{ inputs.severity }}" \
          --ignore-unfixed \
          --exit-code "${exit_code}" \
          --no-progress \
          "${{ inputs.path }}"