fix(action): install cve-lite-cli via npm and add bin to GITHUB_PATH (#692)

npx on npm 10.x fails to resolve the cve-lite binary from the
cve-lite-cli package regardless of syntax. Switch to an explicit
npm install --prefix step that adds the bin directory to GITHUB_PATH,
making cve-lite available in all subsequent steps without PATH issues.

Author: sonukapoor

action.yml

@@ -120,12 +120,19 @@ runs:
           echo "offline-db=${resolved_offline_db}"
         } >> "$GITHUB_OUTPUT"
 
+    - name: Install CVE Lite CLI
+      shell: bash
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
+      run: |
+        npm install --prefix "$RUNNER_TEMP/cve-lite-install" "cve-lite-cli@${INPUT_VERSION}"
+        echo "$RUNNER_TEMP/cve-lite-install/node_modules/.bin" >> "$GITHUB_PATH"
+
     - name: Sync local advisory database
       if: ${{ inputs.sync-advisories == 'true' }}
       shell: bash
       working-directory: ${{ github.workspace }}
       env:
-        INPUT_VERSION: ${{ inputs.version }}
         OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
         INPUT_CA_CERT: ${{ inputs.ca-cert }}
       run: |
@@ -135,13 +142,12 @@ runs:
         if [[ -n "${INPUT_CA_CERT}" ]]; then
           sync_args+=("--ca-cert" "${INPUT_CA_CERT}")
         fi
-        npx --yes --package "cve-lite-cli@${INPUT_VERSION}" cve-lite "${sync_args[@]}"
+        cve-lite "${sync_args[@]}"
 
     - name: Run CVE Lite CLI scan
       shell: bash
       working-directory: ${{ github.workspace }}
       env:
-        INPUT_VERSION: ${{ inputs.version }}
         PROJECT_PATH: ${{ steps.resolve.outputs.project-path }}
         USE_OFFLINE: ${{ steps.resolve.outputs.use-offline }}
         OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
@@ -202,4 +208,4 @@ runs:
           args+=("--ca-cert" "${INPUT_CA_CERT}")
         fi
 
-        npx --yes --package "cve-lite-cli@${INPUT_VERSION}" cve-lite "${args[@]}"
+        cve-lite "${args[@]}"