CloudBees action: Scan with Trivy

Use this action to scan container images with the Trivy scanner, to identify and fix security vulnerabilities.

All CloudBees action repositories are listed at CloudBees, Inc. on GitHub.

Inputs

Table 1. Input details
Input name	Data type	Required?	Description
`image-location`	String	Yes	The container image location.
`image-tag`	String	Yes	The container image tag.
`server-url`	String	Yes	The Trivy server URL.

Usage example

In your YAML file, add:

      - name: Scan with Trivy
        uses: https://github.com/cloudbees-io/trivy-scan-container@v1
        with:
          image-location: "example.com/local/alpine"
          image-tag: "latest"
          server-url: "${{ vars.TRIVY_SERVER_URL }}"▼

Example: Testing container images with Trivy

Integrate the security scanning tool, Trivy to detect vulnerabilities in container images, dependencies, and base layers before deployment.

Use Cases for testing container images

Trivy helps ensure container security by identifying vulnerabilities early in the development process, allowing teams to proactively address risks before deployment.

Vulnerability scanning

Scan container images to identify security vulnerabilities before deployment.

For example, scan an image for CVEs (common vulnerabilities and exposures):

trivy image my-app:latest▼

Another example using Trivy to scan container images for vulnerabilities in a CloudBees workflow:

steps:
  - name: Scan Image for Vulnerabilities
    uses: aquasecurity/trivy-action@v0.8.0
    with:
      image-ref: my-app:latest
      format: table▼

Static code analysis

Perform automated code reviews inside the containerized environment. For example:

steps:
  - name: Run Static Analysis
    uses: github/super-linter@latest
    with:
      dockerfile-lint: true
      json-lint: true▼

Functional and unit testing in containers

Run application-specific tests within pre-configured test environments.

For example, execute Jest tests in a Node.js container:

docker run --rm -v $(pwd):/app -w /app node:16 npm test▼

Another example, to integrate Jest tests in a CloudBees workflow:

steps:
  - name: Run Jest Tests
    uses: actions/setup-node@v2
    with:
      node-version: '16'
  - run: npm test▼

Integration testing

Validate containerized microservices within a CloudBees-managed testing environment.

For example, start a database service and run integration tests against it:

jobs:
  integration-tests:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:13
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: testdb
    steps:
      - run: npm run integration-test▼

Compliance and policy enforcement

Ensure containers meet security policies before production deployment.

For example, run Open Policy Agent (OPA) checks on Kubernetes configurations:

steps:
  - name: Run OPA Policy Check
    uses: open-policy-agent/setup-opa@v2
    with:
      policy: my-policy.rego
      input: deployment.yaml▼