feat: add token input and pin github-server-url

[DmitriyLewen]

Description

GHES overwrites github.token. Also default github server for GHES is not http://github.com.

This PR:

• pin http://github.com as github-server-url for actions/checkout. Required so that actions/checkout correctly finds Trivy repository.
• add token input. Default value is github.token (as in actions/checkout). token is required so that users can overwrite invalid (for http://github.com server) GHES token. Despite the fact that Trivy is public repository, checkout gives an error when the token is invalid.

Test runs:

• token input doesn't exist - https://github.com/DmitriyLewen/test-trivy-action/actions/runs/11492659578
• invalid token - https://github.com/DmitriyLewen/test-trivy-action/actions/runs/11492667423
• PAT with public_repo only - https://github.com/DmitriyLewen/test-trivy-action/actions/runs/11492666014

Related issues:

• Close Setup action v0.2.1 failing on GitHub Enterprise Server #10

[DmitriyLewen]

@BAiler-ai confirmed that these changes work for GHES - aquasecurity/trivy-action#418 (comment)

[knqyf263]

Do we still need this step if we set the default value of token like actions/checkout? inputs.token points to the default GitHub token if token is not specified.

[DmitriyLewen]

initially, I used ${{ github.token }} as default value for inputs.token.

But actions/checkout doesn't work if token is empty (but works if token is specified) - https://github.com/DmitriyLewen/test-trivy-action/actions/runs/11476162864/job/31935565983

So, there are 2 ways to avoid errors in trivy-action:

• use ${{ github.token }} as default value for token-setup-trivy in trivy-action.
• add step in setup-trivy (my way).

I thought it's better to add step in setup-trivy to avoid questions in trivy-action about using ${{ github.token }}.
But if you want, I can use the 1st method.

Example:
setup-trivy (${{ github.token }} is default value for inputs.token) - https://github.com/DmitriyLewen/setup-trivy/blob/0faeae687c92b01123d6eaafbe78091bc8b610eb/action.yaml
trivy-action (`` is default value for inputs.token-setup-trivy)- https://github.com/DmitriyLewen/trivy-action/blob/e78daca2a1cb92de6fd1ba645bd146b851efc10c/action.yaml
test run - https://github.com/DmitriyLewen/test-trivy-action/actions/runs/11476162864/job/31935565983

[knqyf263]

initially, I used ${{ github.token }} as default value for inputs.token.

What changed your mind to go for the second approach (additional step)? Is there any benefit?

But actions/checkout doesn't work if token is empty (but works if token is specified) - https://github.com/DmitriyLewen/test-trivy-action/actions/runs/11476162864/job/31935565983

I'm probably missing something, but my suggestion will not fall into this case, right?

[DmitriyLewen]

What changed your mind to go for the second approach (additional step)? Is there any benefit?

I didn't think actions/checkout uses token for public repos.
But IIUC actions/checkout uses same logic as ghcr (you need to use a valid token even if you pull a public image).

That's why I thought trivy-action users would have questions about github.token, how we use it, etc.

So the only benefit would be fewer questions (if any)

I'm probably missing something, but my suggestion will not fall into this case, right?

Since we are using a chain of actions (trivy-action -> setup-trivy -> actions/checkout), we need to set a default value (github.token) for trivy-action and setup-trivy.
If we use an empty default value for trivy-action - setup-trivy will get `` instead of nil and we will get an error.

PS I tried removing default line (I was hoping that would give me nil), but I got the same behavior.

[DmitriyLewen]

I now realized that another plus is that we don't have to set the default value twice.
If there is a need to change it, we will do it in one place

[knqyf263]

Since we are using a chain of actions (trivy-action -> setup-trivy -> actions/checkout), we need to set a default value (github.token) for trivy-action and setup-trivy.

Yes, I suggested adding default: ${{ github.token }}. It wouldn't be empty, right? What's wrong?

[simar7]

Since we are using a chain of actions (trivy-action -> setup-trivy -> actions/checkout), we need to set a default value (github.token) for trivy-action and setup-trivy.

Yes, I suggested adding default: ${{ github.token }}. It wouldn't be empty, right? What's wrong?

Is it because the default: ${{ github.token }} doesn't propagate down the chain of actions? If it does, I don't see why we shouldn't use it as the default.

[DmitriyLewen]

You are right. It seems I have confused myself.

[DmitriyLewen]

I updated this PR.
cc. @knqyf263 @simar7

UPD:
added github.token as default value in trivy-action - https://github.com/aquasecurity/trivy-action/blob/e9e31edcb0a6bd9a9e1c562428ef30e97a3e3464/action.yaml#L118

[simar7]

Suggested change

	version: v0.56.1
	version: v0.56.2

[DmitriyLewen]

Updated in 34d9f0e