skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

scanning-containers-with-trivy-in-cicd

Integrates Trivy container vulnerability scanning into CI/CD pipelines with severity-based quality gates.

954|172|Updated Mar 13, 2026
Search Tags:#docker#container security#devsecops#vulnerability scanning#trivy#sbom#ci/CD
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill scanning-containers-with-trivy-in-cicd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scanning-containers-with-trivy-in-cicd
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/devsecops/scanning-containers-with-trivy-in-cicd
Command: npx skills add https://github.com/xalgord/xalgorix --skill scanning-containers-with-trivy-in-cicd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Container images often ship with known CVEs in OS packages and application dependencies, and teams lack automated gates to block vulnerable images from reaching production registries.

Core Features & Use Cases

  • CI/CD Image Scanning: Run Trivy in GitHub Actions or GitLab CI to scan Docker images for OS and dependency CVEs before pushing to a registry.
  • Misconfiguration Detection: Scan Dockerfiles and Kubernetes manifests for issues like running as root or missing healthchecks using trivy config.
  • Quality Gates & SBOMs: Fail pipelines on CRITICAL/HIGH findings via exit codes, manage exceptions with .trivyignore.yaml, and generate CycloneDX or SPDX SBOMs.
  • Use Case: A team building a Python service adds a GitHub Actions job that builds the image, scans it with trivy-action using exit-code 1, uploads SARIF results to GitHub Security, and only pushes to ECR when the scan passes.

Quick Start

Set up a GitHub Actions workflow that builds my Docker image and blocks the push if Trivy finds any critical or high vulnerabilities.

Frequently Asked Questions about scanning-containers-with-trivy-in-cicd

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Docker images with Trivy in GitHub Actions?▼

Use aquasecurity/trivy-action in a workflow step after building the image, setting image-ref to the built tag, format to sarif, severity to CRITICAL,HIGH, and exit-code to 1. Upload the SARIF output with codeql-action/upload-sarif so results appear in the GitHub Security tab.

How do I fail a CI pipeline when Trivy finds critical vulnerabilities?▼

Set exit-code: '1' (or --exit-code 1 in CLI) with --severity CRITICAL,HIGH so Trivy returns a non-zero code when matching findings exist. SARIF upload alone never fails the job, so the exit code is what enforces the quality gate.

Does Trivy scan Dockerfiles for misconfigurations?▼

Yes, but only with the config scanner: run trivy config . or set scan-type: config in the action. The trivy image command does not check Dockerfile issues like missing USER instructions (DS002) or missing HEALTHCHECK.

Trivy vs Grype for container image scanning?▼

Trivy covers images, filesystems, git repos, IaC misconfigurations, and SBOM generation in one tool, while Grype by Anchore focuses on image and filesystem vulnerability scanning. The skill suggests using Grype as a comparison scanner to validate Trivy results.

Why does Trivy miss vulnerabilities in my multi-stage build?▼

Scanning only the final image misses packages present in build stages or vendored dependencies not included in the final layer. Run trivy fs . on the build context separately to cover language manifests and build-stage packages.

When should I not use Trivy image scanning?▼

Do not use it for runtime container security monitoring (use Falco or runtime agents) or for scanning running production containers. It is also not a substitute for SAST tools when you only need to scan application source code without containerization.

Related Skills

Explore More Software Engineering Skills→
HTRTanHTRTan

docker-automator

Automate Docker image builds, tagging, registry pushes, and container lifecycle management.

Community
Advanced
broadinstitutebroadinstitute
198

Container Vulnerability Management

Scan viral-ngs Docker images with Trivy and triage HIGH/CRITICAL CVEs.

Official
Advanced
vertivolatamvertivolatam
1

Container Security

Automate container security with image scanning, runtime monitoring, and image signing.

Official
Advanced
BagelHoleBagelHole
46

container-scanning

Scan container images for vulnerabilities and misconfigurations using Trivy and Grype.

Community
Intermediate