CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/trivy-image

Configures and runs Trivy for container image scanning: Aqua Security's all-in-one scanner combining vuln + secret + misconfiguration + license detection in one pass; `trivy image {image}` with --severity HIGH,CRITICAL filter; --format sarif/json (incl. scan-embedded CycloneDX; for standalone SBOM generation see syft-generation + cyclonedx-format); .trivyignore CVE suppression file; --ignore-unfixed for actionable filter; --scanners vuln/misconfig/license/secret toggle. Use when the team wants a single tool covering container image security across multiple dimensions, not for producing a standalone CycloneDX SBOM.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

ci-and-composition.mdreferences/

trivy-image CI integration and tool composition

Extracted from trivy-image. The SKILL.md spine keeps the scan commands inline; the full CI workflow and the sister-tool composition table live here.

CI integration

jobs:
  trivy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - run: docker build -t my-app:${{ github.sha }} .
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: my-app:${{ github.sha }}
          format: sarif
          output: trivy.sarif
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          exit-code: 1
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with: { sarif_file: trivy.sarif }

The aquasecurity/trivy-action GHA wraps the CLI plus SARIF upload.

Composition with sister tools

Sister toolUse
syft-generationGenerates standalone SBOM (Trivy embeds SBOM gen but exposes it less)
grype-scanningAlternative scanner; cross-DB consensus on findings
cyclonedx-format, spdx-formatReference for the SBOM formats Trivy outputs
checkov-policyCross-plugin: deeper IaC scanning vs Trivy's image-internal misconfig

references

ci-and-composition.md

SKILL.md

tile.json