cached trivy db

.gitea/workflows/vulnscan.yaml

@@ -1,11 +1,12 @@
-name: Vulnerability Scan
+---
+  name: Vulnerability Scan
   
-on:
+  on:
     schedule:
       - cron: "0 14 * * *"
     workflow_dispatch:
   
-jobs:
+  jobs:
     scan:
       name: Daily Vulnerability Scan
       runs-on: ubuntu-latest
@@ -14,15 +15,30 @@ jobs:
   
       steps:
         - name: Pull docker image
-        run: docker pull docker.asperti.com/${{ github.repository_owner }}/smtp-relay:latest
+          run: docker pull docker.asperti.com/paspo/smtp-relay:latest
+  
+        - uses: actions/cache/restore@v4
+          with:
+            path: |
+              /root/.cache/trivy
+            key: trivy-db
+  
+        - name: Setup trivy
+          run: |
+            wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.57.1/trivy_0.57.1_Linux-64bit.deb
+            dpkg -i /tmp/trivy.deb
   
         - name: Run Trivy vulnerability scanner
           id: scan
-        uses: aquasecurity/trivy-action@master
+          run: |
+            trivy image --format json docker.asperti.com/paspo/smtp-relay:latest > trivy-results.json
+  
+        - uses: actions/cache/save@v4
+          if: always()  # salva in cache anche se trova vulnerabilità
           with:
-          image-ref: "docker.asperti.com/${{ github.repository_owner }}/smtp-relay:latest"
+            path: |
-          format: "json"
+              /root/.cache/trivy
-          output: "trivy-results.json"
+            key: trivy-db
   
         # if some vulnerability is found, we fail
         - name: check output
@@ -40,3 +56,4 @@ jobs:
             format: markdown
             message: |
               Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}`
+