Trivy allow alt db

action.yaml

@@ -97,6 +97,10 @@ inputs:
   docker-host:
     description: 'unix domain socket path to use for docker scanning, ex. unix:///var/run/docker.sock'
     required: false
+  db-repository:
+    description: 'vulnerability DB repository address, ex. my-registry.example.com/mirrors/aquasecurity/trivy-db'
+    required: false
+    default: ''
 
 runs:
   using: 'docker'
@@ -125,5 +129,6 @@ runs:
     - '-u ${{ inputs.github-pat }}'
     - '-v ${{ inputs.trivy-config }}'
     - '-x ${{ inputs.tf-vars }}'
-    - '-z ${{ inputs.limit-severities-for-sarif }}'
     - '-y ${{ inputs.docker-host }}'
+    - '-z ${{ inputs.limit-severities-for-sarif }}'
+    - '-0 ${{ inputs.db-repository }}'

entrypoint.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 set -e
-while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:x:y:z:" o; do
+while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:x:y:z:0:" o; do
    case "${o}" in
        a)
          export scanType=${OPTARG}
@@ -77,6 +77,9 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:x:y:z:" o; do
        z)
          export limitSeveritiesForSARIF=${OPTARG}
        ;;
+       0)
+         export dbRepository=${OPTARG}
+       ;;
   esac
 done
 
@@ -184,6 +187,10 @@ if [ "$skipFiles" ];then
   done
 fi
 
+if [ $dbRepository ]; then
+  ARGS="$ARGS --db-repository $dbRepository"
+fi
+
 trivyConfig=$(echo $trivyConfig | tr -d '\r')
 # To make sure that uploda GitHub Dependency Snapshot succeeds, disable the script that fails first.
 set +e