Trivy GitLab CI Component

A GitLab CI component for Trivy — the all-in-one security scanner covering container images, filesystems, repositories, Kubernetes clusters, SBOMs, and license compliance. Plug these templates directly into your pipelines to get repeatable scans, GitLab-native reports, and portable artifacts with almost no shell scripting.

Features

• Full Surface Coverage: Containers, filesystems, root filesystems, Git repositories, VMs, SBOMs, Kubernetes clusters, and more.
• Multiple Scanners: Vulnerability, misconfiguration/IaC, secret, and license scanning with per-job controls.
• GitLab Reports: Emits Container Scanning, JUnit, SARIF, and JSON artifacts ready for merge-request insights.
• Customizable Inputs: Every template exposes knobs for severities, scanners, timeouts, package types, and artifacts.
• Composable Templates: Mix remote or local scans, SBOM workflows, Rekor attestations, and IaC checks from one component namespace.

Usage

Basic Usage

include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/main@latest

stages:
  - test

Remote Image With Custom Severity

include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/main@latest
    inputs:
      job_name: "security:remote"
      TRIVY_SCAN_REMOTE_IMAGE: "registry.gitlab.com/group/app:latest"
      severity: "CRITICAL,HIGH,MEDIUM"
      exit_on_vulnerability: true

stages:
  - test

Local Tar / OCI Layout Scan

include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/main@latest
    inputs:
      job_name: "security:local"
      TRIVY_SCAN_LOCAL_IMAGES: "dist/"
      TRIVY_SCANNERS: "vuln,secret"
      exit_on_vulnerability: false

stages:
  - test

Component Inputs & Templates

Each template below lists its available inputs and defaults as defined in the component spec, followed by a minimal working example.

Component: templates/main.yml

Input	Description	Default
job_name	Name of the CI job	"trivy scanning"
stage	Pipeline stage	"test"
image	Container image running Trivy	"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_NEEDED_STAGE	Stage that must finish before Trivy runs	"build"
TRIVY_SCAN_REMOTE_IMAGE	Remote image to scan	""
TRIVY_SCAN_LOCAL_IMAGES	Path to tar/OCI inputs (searches . when empty)	""
TRIVY_SCANNERS	Comma-separated scanners	"vuln,secret,misconfig"
severity	Severities to include	"CRITICAL,HIGH"
exit_on_vulnerability	Fail job when issues found	true
TRIVY_EXTRA_ARGS	Additional CLI flags	""
allow_failure	Allow job failure without failing pipeline	false

Example

include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/main@latest
    inputs:
      job_name: "trivy:basic"
      TRIVY_SCAN_REMOTE_IMAGE: "nginx:latest"

Component: templates/target_container.yml

Input	Description	Default
job_name	CI job name	"trivy:scan:containers"
stage	Pipeline stage	"test"
image	Trivy container image	"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_SCAN_REMOTE_IMAGE	Remote image reference	""
TRIVY_SCAN_LOCAL_IMAGES	Directory/tar for local scans	""
TRIVY_SCANNERS	Enabled scanners	"vuln,secret,misconfig"
TRIVY_IMAGE_SRC	Image source backend (remote/docker/...)	""
severity	Severities	"CRITICAL,HIGH"
exit_on_vulnerability	Fail on severity match	true
TRIVY_IGNORE_UNFIXED	Ignore issues without fixes	true
TRIVY_PKG_TYPES	Package types	"os,library"
TRIVY_VULN_TYPE	Deprecated alias for pkg types	""
TRIVY_TIMEOUT	Command timeout	"10m"
TRIVY_EXTRA_ARGS	Extra CLI args	""
TRIVY_DB_REPOSITORY	Custom DB mirror	""
TRIVY_JAVA_DB_REPOSITORY	Custom Java DB mirror	""
TRIVY_SKIP_FILES	File glob exclusions	""
TRIVY_SKIP_DIRS	Directory exclusions	""
allow_failure	Allow failure without failing pipeline	false

Example

include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_container@latest
    inputs:
      job_name: "trivy:containers"
      TRIVY_SCAN_REMOTE_IMAGE: "registry.gitlab.com/group/service:latest"
      TRIVY_SCANNERS: "vuln,secret"
      exit_on_vulnerability: true

Component: templates/target_filesystem.yml

Input	Description	Default
job_name	CI job name	"trivy:scan:filesystem"
stage	Pipeline stage	"test"
image	Trivy image	"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_FS_PATH	File or directory to scan	"."
TRIVY_SCANNERS	Enabled scanners	"vuln,secret"
severity	Severities	"CRITICAL,HIGH"
exit_on_vulnerability	Fail on severity match	true
TRIVY_IGNORE_UNFIXED	Ignore unfixed issues	true
TRIVY_PKG_TYPES	Package types	"os,library"
TRIVY_TIMEOUT	Timeout	"10m"
TRIVY_SKIP_FILES	File globs to skip	""
TRIVY_SKIP_DIRS	Directories to skip	""
TRIVY_EXTRA_ARGS	Extra CLI args	""
TRIVY_REPORT_BASENAME	Artifact base name	"filesystem-scan"
allow_failure	Allow job failure	false

Example

include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_filesystem@latest
    inputs:
      TRIVY_FS_PATH: "services/api"
      TRIVY_SCANNERS: "vuln,misconfig,secret"

Component: templates/target_rootfs.yml

Input	Description	Default
job_name	Job name	"trivy:scan:rootfs"
stage	Stage	"test"
image	Trivy image	"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_ROOTFS_PATH	Root filesystem path	"/"
TRIVY_SCANNERS	Scanners	"vuln,secret"
severity	Severities	"CRITICAL,HIGH"
exit_on_vulnerability	Fail job on findings	true
TRIVY_IGNORE_UNFIXED	Ignore unfixed	true
TRIVY_PKG_TYPES	Package types	"os,library"
TRIVY_TIMEOUT	Timeout	"10m"
TRIVY_SKIP_FILES	Files to skip	""
TRIVY_SKIP_DIRS	Directories to skip	""
TRIVY_EXTRA_ARGS	Extra args	""
TRIVY_REPORT_BASENAME	Artifact basename	"rootfs-scan"
allow_failure	Allow failure	false

Example

include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_rootfs@latest
    inputs:
      TRIVY_ROOTFS_PATH: "/mnt/root"
      TRIVY_SCANNERS: "vuln"

Component: templates/target_repository.yml

Input	Description	Default
job_name	Job name	"trivy:scan:repo"
stage	Stage	"test"
image	Trivy image	"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_REPO_TARGET	Local path or Git URL	"."
TRIVY_REPO_BRANCH	Remote branch	""
TRIVY_REPO_COMMIT	Commit hash	""
TRIVY_REPO_TAG	Tag name	""
TRIVY_SCANNERS	Scanners	"vuln,secret"
severity	Severities	"CRITICAL,HIGH"
exit_on_vulnerability	Fail job on findings	true
TRIVY_IGNORE_UNFIXED	Ignore unfixed	true
TRIVY_TIMEOUT	Timeout	"10m"
TRIVY_SKIP_FILES	Files to skip	""
TRIVY_SKIP_DIRS	Dirs to skip	""
TRIVY_EXTRA_ARGS	Extra args	""
TRIVY_REPORT_BASENAME	Artifact basename	"repo-scan"
allow_failure	Allow failure	false

Example

include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_repository@latest
    inputs:
      TRIVY_REPO_TARGET: "https://github.com/aquasecurity/trivy"
      TRIVY_REPO_BRANCH: "main"

Component: templates/target_vm.yml