ci: cache trivy-test-images

[knqyf263]

Description

Currently, we pull test images every time we run integration/module/VM tests on GitHub Actions.

trivy/magefiles/fixture.go

Line 35 in 8128ecc

img, err := crane.Pull(imgName)

trivy/magefiles/fixture.go

Line 89 in 8128ecc

if err = saveLayer(layer, filePath); err != nil {

These images are rarely changed and should be cached on GitHub Actions to mitigate 429 errors.

Downloading spring4shell-jre11...
Downloading spring4shell-jre[8](https://github.com/aquasecurity/trivy/actions/runs/11045901509/job/30685527564#step:5:9)...
Downloading almalinux-8...
Downloading alpine-3[9](https://github.com/aquasecurity/trivy/actions/runs/11045901509/job/30685527564#step:5:10)...
Error: GET https://ghcr.io/v2/aquasecurity/trivy-test-images/blobs/sha256:e7c96db7181be991f19a9fb6975cdbbd73c65f4a2681348e63a141a2192a5f[10](https://github.com/aquasecurity/trivy/actions/runs/11045901509/job/30685527564#step:5:11): TOOMANYREQUESTS: retry-after: 339.865µs, allowed: 44000/minute

cf. https://github.com/aquasecurity/trivy/actions/runs/11045901509/job/30685527564

[gerhard]

Hi @knqyf263,

We started hitting this issue in our pipeline. What are your thoughts on this workaround?

• Hitting TOOMANYREQUESTS for scan-engine job dagger/dagger#8644 (comment)

[DmitriyLewen]

Hello @gerhard
Related discussion - #7538

IIUC you use token from config.json in trivy container.
But it doesn't always help - #7580

[gerhard]

That was helpful @DmitriyLewen , thank you.

This comment confirms my initial suspicion of this being a rate limit on the ghcr.io/aquasecurity/trivy repository: #7580 (comment)

I'm thinking that we should go with --db-repository public.ecr.aws/aquasecurity/trivy-db as the short-term fix: https://github.com/orgs/community/discussions/139074#discussioncomment-10808081

[veselov]

If your image has java stuff in it, also add --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db

[DmitriyLewen]

@veselov
small correction - if you have jar(or other java archives - e.g. war) file.
Because Trivy uses trivy-java-db only for them. (Trivy doesn't use trivy-java-db for pom.xml files).