vulnerability-scan

Use Trivy in your CI pipeline to scan container images with the command trivy image --severity CRITICAL,HIGH and exit-code 1 to fail builds. The aquasecurity/trivy-action GitHub Action integrates this directly and can upload SARIF results to GitHub Security.

Trivy covers containers, filesystems, and IaC misconfigurations in one tool, while Grype focuses on application and OS package vulnerabilities. This workflow uses Trivy as the primary scanner because it also handles Terraform config scanning and SBOM generation.

Add the CVE ID to a .trivyignore file with a justification comment and an expiry date. Expiry dates force periodic re-evaluation so accepted risks do not become permanent undocumented debt.

Block CI only on CRITICAL severity findings with known fixes, and create tickets for HIGH findings instead of blocking. Blocking on every severity causes alert fatigue and encourages teams to bypass scanning entirely.

Prioritize by exploitability rather than raw CVSS score: check whether the vulnerable code path is reachable, whether the service is network-exposed, and whether authentication is required. A CRITICAL CVE in unreachable code is lower risk than a HIGH CVE in a public login endpoint.

An SBOM (Software Bill of Materials) is a machine-readable inventory of all components in a release, generated here in CycloneDX format via Trivy. It enables rapid impact assessment when a zero-day vulnerability is disclosed in any dependency.