Skip to content
Slipwaydocs

Trivy

Image, filesystem and IaC scanning.

At a glance

Section titled “At a glance”
Category Security scanning
Authentication None (runs in the job)
Provider id trivy

What it does

Section titled “What it does”
  • SARIF/JSON report ingest
  • Severity policy gates

Set up

Section titled “Set up”
  1. Add the scanner step to your pipeline (a uses: step or a container image).
  2. Upload the report (SARIF, JSON or SBOM) through the scan-report ingest API so Slipway can show findings on the run.
  3. Add a CEL policy gate on the environment, for example scan.critical == 0.

Configuration

Section titled “Configuration”

Illustrative configuration. Non-secret settings are stored as integration config; credentials are stored as encrypted Slipway secrets and referenced by name.

steps:
  - name: Scan image
    run: trivy image --format sarif --output trivy.sarif ${{ needs.build.outputs.image }}
  - name: Keep the report
    uses: slipway/artifact-upload@v1
    with: { name: trivy-report, path: trivy.sarif }

Notes

Section titled “Notes”

Reports are ingested through IntegrationService.IngestScanReport (see the API docs). A first-party upload step is planned.

Section titled “Related”