Add Trivy container security scanning #205
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit integrates Trivy vulnerability scanning into the Dockyard pipeline to provide comprehensive container security scanning. ## Changes ### PR-Level Scanning (build-containers.yml) - Add Trivy scan step after container build - Scan for CRITICAL, HIGH, and MEDIUM severity vulnerabilities - Upload SARIF results to GitHub Security tab (Code Scanning) - Non-blocking: provides visibility without stopping PRs - Add security-events permission for SARIF upload ### Periodic Scanning (new workflow) - Add periodic-security-scan.yml workflow - Runs weekly (Monday 2am UTC) on all published images - Comprehensive scan: vulnerabilities, secrets, configs, licenses - Auto-creates GitHub issues for CRITICAL findings or detected secrets - Smart issue management: updates existing issues instead of duplicates - Manual trigger available for on-demand scans - 90-day artifact retention for audit trail ### Documentation (README.md) - Add "Container Vulnerability Scanning" section - Document Trivy integration and scan schedules - Update "Security Guarantees" section - Update pipeline diagram to include Trivy scan step ## Benefits 1. **Continuous Monitoring**: Catches newly disclosed CVEs in published images 2. **Early Detection**: Developers see vulnerabilities during PR review 3. **Actionable Results**: GitHub Security tab integration for easy review 4. **Comprehensive**: Scans OS packages, dependencies, secrets, and configs 5. **Low Maintenance**: Trivy auto-updates vulnerability database 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
rdimitrov
approved these changes
Nov 25, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR integrates Trivy container security scanning into the Dockyard pipeline to provide comprehensive vulnerability detection for all built container images.
What's Changed
🔍 PR-Level Scanning
📅 Periodic Scanning (New Workflow)
📚 Documentation Updates
Technical Details
Files Changed
.github/workflows/build-containers.yml- Added Trivy scan step after build.github/workflows/periodic-security-scan.yml- New workflow for periodic scansREADME.md- Documentation updatesPermissions Added
security-events: write- Required for SARIF upload to GitHub Security tabBenefits
Why Trivy?
After deep research comparing Trivy vs Grype:
Testing
The PR workflow will:
Note: Since no MCP server configs changed, container builds won't trigger, but the workflow syntax will be validated.
Future Enhancements (Optional)
🤖 Generated with Claude Code
Co-Authored-By: Claude noreply@anthropic.com