security

Generate a Tekton Task that scans container images with Trivy for CRITICAL and HIGH vulnerabilities.

Updated Feb 23, 2026

Search Tags:#pipeline #ci #trivy #tekton #container-security #vulnerability-scanning

Ready to run

npx skills add https://github.com/lordofthejars/hello-world-tekton-bob --skill security-lordofthejars

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security
Source: https://github.com/lordofthejars/hello-world-tekton-bob/tree/main/skills/security
Command: npx skills add https://github.com/lordofthejars/hello-world-tekton-bob --skill security-lordofthejars

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects severe vulnerabilities in container images during CI pipelines and prevents insecure images from progressing through Tekton workflows, reducing the risk of shipping exploitable software.

Core Features & Use Cases

Tekton Task Generation: Produces a Tekton Task definition that runs a Trivy scan as a pipeline step.
Severity-Filtered Failure: Configures the task to fail the pipeline only when CRITICAL or HIGH vulnerabilities are detected.
CI Integration Use Case: Integrate into a Tekton pipeline to automatically scan built images and abort deployments when high-severity flaws are present.

Quick Start

Generate a Tekton Task that scans the specified container image with Trivy and fails only if CRITICAL or HIGH vulnerabilities are found.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a container image for vulnerabilities in a Tekton pipeline?▼

To scan a container image in a Tekton pipeline, you generate a Tekton Task definition that runs a Trivy scan as a pipeline step. This task accepts an image-name parameter and uses the aquasec/trivy:0.50.0 image to perform the vulnerability scan.

Can I make a Tekton pipeline fail only on CRITICAL or HIGH vulnerabilities?▼

Yes, you can configure a Tekton pipeline to abort only on CRITICAL or HIGH vulnerabilities by integrating a Trivy scan task. The task enforces exit code 1 specifically when severe findings are detected, preventing insecure container images from progressing.

What does Trivy exit code 1 mean in a CI pipeline?▼

Trivy exit code 1 in a CI pipeline indicates that CRITICAL or HIGH vulnerabilities were found during the container image scan. This severity-filtered failure mechanism ensures the Tekton workflow aborts only when severe security flaws are present.

How do I stop insecure container images from deploying in CI?▼

To stop insecure container images from deploying in CI, integrate a Trivy scan step into your Tekton pipeline. This enforces exit code 1 when CRITICAL or HIGH vulnerabilities are detected, reducing the risk of shipping exploitable software.

Do I need to install Trivy separately to scan images in Tekton?▼

No, you do not need to install Trivy separately to scan images in Tekton. The generated task uses the aquasec/trivy:0.50.0 container image to execute the vulnerability scan directly within the pipeline step environment.