bug: GitHub Action passes --no-cache with offline mode, which the CLI rejects

[Ayush7614]

Summary

The GitHub Action defaults no-cache to "true" and always appends --no-cache when that input is true. Offline mode (offline, offline-db, or sync-advisories) also appends --offline-db. The CLI treats those flags as mutually exclusive, so the default Action offline config fails before scanning.

Expected

- uses: OWASP/cve-lite-cli@v1
  with:
    offline: "true"
    # no-cache left at default "true"

Should run an offline scan successfully. --no-cache is meaningless offline (no OSV query cache to bypass).

Actual

CLI exits 1 immediately:

Error: --no-cache cannot be used with --offline or --offline-db

Root cause

action.yml:

• no-cache input defaults to "true" (CI-oriented)
• scan step (and fix step) independently append --offline-db when USE_OFFLINE=true and --no-cache when INPUT_NO_CACHE=true

src/cli/validate.ts:

if (options.noCache && (options.offline || options.offlineDb)) {
  throw new Error("--no-cache cannot be used with --offline or --offline-db");
}

Docs (website/docs/caching.md, CHANGELOG) document the same mutual exclusion.

Impact

Any Action workflow that enables offline scanning without explicitly setting no-cache: "false" is broken out of the box — including offline: true, offline-db: ..., and sync-advisories: true.

Suggested fix

When USE_OFFLINE=true, omit --no-cache from the constructed CLI args (scan + fix steps). Optionally document that no-cache is ignored in offline mode.

Workaround today: set no-cache: "false" whenever offline inputs are used.

Reproduce

# Equivalent to what the Action builds by default for offline scans:
cve-lite . --offline-db ./.cache/cve-lite/advisories.db --no-cache
# Error: --no-cache cannot be used with --offline or --offline-db

[sonukapoor]

Confirmed, thanks @Ayush7614: action.yml appends --no-cache (its default is true) independently of --offline-db, and the CLI rejects that combination, so enabling offline: true on the Action breaks on the first run. The fix is contained to action.yml, skipping --no-cache when offline mode is on, in both the scan and fix steps.

Want to take this one? It's small and self-contained.

[Ayush7614]

Thanks @sonukapoor — yes, I'll take this one. Skipping --no-cache when USE_OFFLINE=true in both the scan and fix steps, then opening a focused PR.