Trivy allow alt db

[billhammond-dev]

This change allows users to select an alternative DB repo for the database.

I have tested this without the new input being specified, and also by using an ECR pull through repo pointing back at GHCR as the input for the alternative db repository. This will allow for a workaround in case of issues with GHCR/etc and also (if enough folks use this) reduce direct load on GHCR

[CLAassistant]

All committers have signed the CLA.

[billhammond-dev]

#389

[xomgc3]

🚀 🙏🏻

[simar7]

This is already possible by specifying the trivy config.yaml as an input to the action https://aquasecurity.github.io/trivy/v0.55/docs/references/configuration/config-file/#db-options

You can see an example here: https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#scan-ci-pipeline-w-trivy-config

[jpalomaki]

@billhammond-dev You can also specify these via environment variables in the trivy scan step (documented here):

- uses: aquasecurity/[email protected]
  with:
    ...
  env:
    TRIVY_DB_REPOSITORY: <something else than ghcr.io>
    TRIVY_JAVA_DB_REPOSITORY: <something else than ghcr.io>

We are also looking to use AWS ECR pull through cache repositories to workaround.

[nnellanspdl]

So, if I understand this correctly:

I, as the consumer of this action, must download copies of these DBs and store them on my own registry. Then, I must pass environment variables to the action which point at my copies of the DBs. Is that correct?

How often are these DBs updated?