Container Image Vulnerability Scanning in CI/CD with Trivy

1
name: Container Vulnerability Scan
2

3
on:
4
  push:
5
    branches: [main]
6
    paths:
7
      - 'Dockerfile'
8
      - 'src/**'
9
  pull_request:
10
    branches: [main]
11

12
jobs:
13
  trivy-scan:
14
    runs-on: ubuntu-latest
15
    steps:
16
      - uses: actions/checkout@v3
17

18
      - name: Set up Docker Buildx
19
        uses: docker/setup-buildx-action@v2
20

21
      - name: Build Docker image
22
        uses: docker/build-push-action@v4
23
        with:
24
          context: .
25
          file: ./Dockerfile
26
          push: false
27
          load: true
28
          tags: my-app:${{ github.sha }}
29

30
      - name: Run Trivy vulnerability scan
31
        uses: aquasecurity/trivy-action@master
32
        with:
33
          image-ref: my-app:${{ github.sha }}
34
          format: 'sarif'
35
          output: 'trivy-results.sarif'
36
          severity: 'CRITICAL,HIGH'
37

38
      - name: Upload Trivy results to GitHub Security
39
        uses: github/codeql-action/upload-sarif@v2
40
        with:
41
          sarif_file: 'trivy-results.sarif'
42

43
      - name: Fail if critical vulnerabilities found
44
        run: |
45
          trivy image --severity CRITICAL my-app:${{ github.sha }} --exit-code 1

1
stages:
2
  - build
3
  - scan
4

5
build:
6
  stage: build
7
  image: docker:latest
8
  services:
9
    - docker:dind
10
  script:
11
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
12
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
13

14
scan:
15
  stage: scan
16
  image: aquasec/trivy:latest
17
  script:
18
    - trivy image --severity HIGH,CRITICAL --exit-code 1 $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
19
  allow_failure: false

1
# Define what constitutes a vulnerability violation
2
severity: HIGH,CRITICAL
3

4
# Ignore specific CVEs for known/accepted risks
5
ignorefile: .trivyignore
6

7
# Policy for failing builds
8
exit-code: 1
9

10
# Require sign-off for medium severity
11
medium-requires-approval: true

# Format: CVE-XXXX-XXXXX [optional: expiration date]

# Known false positive or acceptable risk (expires 2026-12-31)
CVE-2024-1234 2026-12-31

# Permanently ignore (use with caution)
CVE-2024-5678

1
name: Production Container Security
2

3
on:
4
  schedule:
5
    # Run daily scans
6
    - cron: '0 2 * * *'
7
  workflow_dispatch:
8

9
jobs:
10
  scan-all-images:
11
    runs-on: ubuntu-latest
12
    strategy:
13
      matrix:
14
        image:
15
          - my-app:latest
16
          - api-gateway:latest
17
          - worker-service:latest
18

19
    steps:
20
      - uses: aquasecurity/trivy-action@master
21
        with:
22
          image-ref: ${{ matrix.image }}
23
          format: 'json'
24
          output: 'trivy-${{ matrix.image }}.json'
25
          severity: 'CRITICAL,HIGH,MEDIUM'
26

27
      - name: Archive results
28
        uses: actions/upload-artifact@v3
29
        with:
30
          name: trivy-reports
31
          path: trivy-*.json
32

33
      - name: Notify security team
34
        if: failure()
35
        run: |
36
          curl -X POST -H 'Content-type: application/json' \
37
            --data '{"text":"Critical vulnerabilities found in ${{ matrix.image }}"}' \
38
            ${{ secrets.SLACK_WEBHOOK_URL }}