skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-aqua-security-for-container-scanning

Deploy Trivy to scan container images for vulnerabilities, misconfigurations, secrets, and SBOM data in CI/CD pipelines.

954|172|Updated Mar 13, 2026
Search Tags:#kubernetes#devsecops#vulnerability scanning#trivy#sbom#ci/CD#container scanning
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-aqua-security-for-container-scanning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-aqua-security-for-container-scanning
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/devsecops/implementing-aqua-security-for-container-scanning
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-aqua-security-for-container-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Container images often ship with known CVEs, exposed secrets, and misconfigurations because teams lack automated scanning gates in their build pipelines. This Skill guides the deployment of Aqua Security's Trivy scanner so vulnerable images fail the build before reaching production.

Core Features & Use Cases

  • Image and Filesystem Scanning: Scan container images, registries, lockfiles, and git repositories for CVEs in OS packages and language dependencies.
  • CI/CD Gating: Integrate Trivy into GitHub Actions, GitLab CI, and Jenkins with exit-code enforcement so CRITICAL and HIGH findings fail the pipeline.
  • Kubernetes and IaC Coverage: Deploy the Trivy Operator for continuous cluster scanning and audit Terraform, Dockerfiles, and Kubernetes manifests for misconfigurations.
  • Use Case: A platform team adds a Trivy step to their GitHub Actions workflow that builds an image by commit SHA, scans it with --exit-code 1 --severity CRITICAL,HIGH, and uploads SARIF results to the GitHub Security tab.

Quick Start

Set up a Trivy scan in my CI pipeline that builds my Docker image, fails the build on CRITICAL or HIGH vulnerabilities, and uploads the results as a SARIF report.

Frequently Asked Questions about implementing-aqua-security-for-container-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fail a CI build when Trivy finds critical vulnerabilities?▼

Run Trivy with the flags --exit-code 1 --severity CRITICAL,HIGH so the scan returns a non-zero exit code when matching findings exist. In GitHub Actions, also remove any continue-on-error setting on the gating step, since it overrides the exit code.

How do I integrate Trivy container scanning into GitHub Actions?▼

Build the image tagged with the commit SHA, then run aquasecurity/trivy-action with image-ref pointing to that tag, format sarif, and exit-code 1. Upload the SARIF output with github/codeql-action/upload-sarif so results appear in the GitHub Security tab.

Can Trivy scan Kubernetes clusters continuously?▼

Yes, the Trivy Operator installs via Helm into the cluster and continuously scans running workloads. It produces VulnerabilityReport and ConfigAuditReport custom resources for each workload, with configurable severity filters and scan job timeouts.

Why does my Trivy scan pass even though the image has critical CVEs?▼

Common causes include using --exit-code 0 which only reports, scanning a stale :latest tag instead of the built digest, an over-broad .trivyignore file, or --ignore-unfixed hiding fixable CVEs. Verify by scanning a known-vulnerable base image and confirming the pipeline fails.

Does Trivy support SBOM generation for container images?▼

Yes, Trivy generates SBOMs in CycloneDX and SPDX formats using trivy image --format cyclonedx or spdx-json. You can also rescan an existing SBOM later with trivy sbom to detect newly published vulnerabilities without rebuilding the image.

Related Skills

Explore More Software Engineering Skills→
deandumdeandum
3

ops/registry

Push container images to registries with immutable tags and signing.

Community
Advanced
riparinoriparino
1

defensive-vulnerability-management

Automates vulnerability prioritization and remediation using KQL enrichment and patch verification.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

policy-as-code-template-library

Automate Kubernetes governance and security policy enforcement with Kyverno and OPA templates.

Official
Intermediate
tylern91tylern91

container-scanning

Automate container-image vulnerability scanning and security misconfiguration checks.

Community
Advanced