fix: bump setup-trivy and add new contrib directory path info

[DmitriyLewen]

Description

Before migrating to composite action contrib dir was stored in /contrib.

But we can't use that path now.
This PR:

• bump setup-trivy to v0.2.2. This version keeps contrib dir next to trivy binary ($HOME/.local/bin/trivy-bin/contrib).
• update README.MD about using templates.

Test run - https://github.com/DmitriyLewen/test-trivy-action/actions/runs/11493490734/job/31989270311

Related Issues

• Close Trivy scan started failing recently for html format #410

Related PRs

• fix: add contrib dir setup-trivy#13

[DmitriyLewen]

@simar7 tests fail.
Are there any changes in trivy-checks that could be causing this?

[nikpivkin]

@DmitriyLewen We do not use trivy-checks here. We created a copy of the package so that small changes in trivy-checks would not affect the tests.

[DmitriyLewen]

hm... then I have no idea why the tests fail...

i updated readme file in last commit.
for last commit tests fail
for previous commit tests passed

[nikpivkin]

@simar7 did you run this action to upgrade the package to version 1?

[nikpivkin]

Apparently the tests use a copy of the old package before migrating to Rego, so if the package download fails due to a 429 error, Trivy uses the embedded checks.

[DmitriyLewen]

Got it! Thanks for checking.

I have one more question:
Is it possible to disable the use of embedded checks and simply return an error when receiving a 429 error?

[nikpivkin]

@DmitriyLewen Unfortunately there is no such option.

[simar7]

@simar7 did you run this action to upgrade the package to version 1?

@nikpivkin I just did https://github.com/aquasecurity/trivy-action/actions/runs/11512481974/job/32047569473 although re-running the tests they're still red. Do we have to update the tests themselves too?

Maybe we should run this as a cron job to update these.

[simar7]

@DmitriyLewen @nikpivkin I merged it for now, let's fix the tests in another PR.

[nikpivkin]

Do we have to update the tests themselves too?

The tests were deleted here #387 , so they need to be restored

[nikpivkin]

Maybe we should run this as a cron job to update these.

Then there is no point in keeping a copy of the checks bundle. What if we use custom checks for tests to get rid of this dependency?