Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitLabGitLab/niclas-zone/ci/trivy
Vulnerability ScannersContainer SecurityCloud SecurityDevSecOpsSecret DetectionSupply Chain SecurityMisconfiguration
GitLabniclas-zone/ci/trivy

trivy

GitLab CI component for Trivy scanning

View Repository
41 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Trivy GitLab CI Component

A GitLab CI component for Trivy — the all-in-one security scanner covering container images, filesystems, repositories, Kubernetes clusters, SBOMs, and license compliance. Plug these templates directly into your pipelines to get repeatable scans, GitLab-native reports, and portable artifacts with almost no shell scripting.

Features

  • Full Surface Coverage: Containers, filesystems, root filesystems, Git repositories, VMs, SBOMs, Kubernetes clusters, and more.
  • Multiple Scanners: Vulnerability, misconfiguration/IaC, secret, and license scanning with per-job controls.
  • GitLab Reports: Emits Container Scanning, JUnit, SARIF, and JSON artifacts ready for merge-request insights.
  • Customizable Inputs: Every template exposes knobs for severities, scanners, timeouts, package types, and artifacts.
  • Composable Templates: Mix remote or local scans, SBOM workflows, Rekor attestations, and IaC checks from one component namespace.

Usage

Basic Usage

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/main@latest

stages:
  - test

Remote Image With Custom Severity

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/main@latest
    inputs:
      job_name: "security:remote"
      TRIVY_SCAN_REMOTE_IMAGE: "registry.gitlab.com/group/app:latest"
      severity: "CRITICAL,HIGH,MEDIUM"
      exit_on_vulnerability: true

stages:
  - test
Download Tool

Local Tar / OCI Layout Scan

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/main@latest
    inputs:
      job_name: "security:local"
      TRIVY_SCAN_LOCAL_IMAGES: "dist/"
      TRIVY_SCANNERS: "vuln,secret"
      exit_on_vulnerability: false

stages:
  - test

Component Inputs & Templates

Each template below lists its available inputs and defaults as defined in the component spec, followed by a minimal working example.

Component: templates/main.yml

InputDescriptionDefault
job_nameName of the CI job"trivy scanning"
stagePipeline stage"test"
imageContainer image running Trivy"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_NEEDED_STAGEStage that must finish before Trivy runs"build"
TRIVY_SCAN_REMOTE_IMAGERemote image to scan""
TRIVY_SCAN_LOCAL_IMAGESPath to tar/OCI inputs (searches . when empty)""
TRIVY_SCANNERSComma-separated scanners"vuln,secret,misconfig"
severitySeverities to include"CRITICAL,HIGH"
exit_on_vulnerabilityFail job when issues foundtrue
TRIVY_EXTRA_ARGSAdditional CLI flags""
allow_failureAllow job failure without failing pipelinefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/main@latest
    inputs:
      job_name: "trivy:basic"
      TRIVY_SCAN_REMOTE_IMAGE: "nginx:latest"

Component: templates/target_container.yml

InputDescriptionDefault
job_nameCI job name"trivy:scan:containers"
stagePipeline stage"test"
imageTrivy container image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_SCAN_REMOTE_IMAGERemote image reference""
TRIVY_SCAN_LOCAL_IMAGESDirectory/tar for local scans""
TRIVY_SCANNERSEnabled scanners"vuln,secret,misconfig"
TRIVY_IMAGE_SRCImage source backend (remote/docker/...)""
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail on severity matchtrue
TRIVY_IGNORE_UNFIXEDIgnore issues without fixestrue
TRIVY_PKG_TYPESPackage types"os,library"
TRIVY_VULN_TYPEDeprecated alias for pkg types""
TRIVY_TIMEOUTCommand timeout"10m"
TRIVY_EXTRA_ARGSExtra CLI args""
TRIVY_DB_REPOSITORYCustom DB mirror""
TRIVY_JAVA_DB_REPOSITORYCustom Java DB mirror""
TRIVY_SKIP_FILES

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_container@latest
    inputs:
      job_name: "trivy:containers"
      TRIVY_SCAN_REMOTE_IMAGE: "registry.gitlab.com/group/service:latest"
      TRIVY_SCANNERS: "vuln,secret"
      exit_on_vulnerability: true

Component: templates/target_filesystem.yml

InputDescriptionDefault
job_nameCI job name"trivy:scan:filesystem"
stagePipeline stage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_FS_PATHFile or directory to scan"."
TRIVY_SCANNERSEnabled scanners"vuln,secret"
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail on severity matchtrue
TRIVY_IGNORE_UNFIXEDIgnore unfixed issuestrue
TRIVY_PKG_TYPESPackage types"os,library"
TRIVY_TIMEOUTTimeout"10m"
TRIVY_SKIP_FILESFile globs to skip""
TRIVY_SKIP_DIRSDirectories to skip""
TRIVY_EXTRA_ARGSExtra CLI args""
TRIVY_REPORT_BASENAMEArtifact base name"filesystem-scan"
allow_failureAllow job failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_filesystem@latest
    inputs:
      TRIVY_FS_PATH: "services/api"
      TRIVY_SCANNERS: "vuln,misconfig,secret"

Component: templates/target_rootfs.yml

InputDescriptionDefault
job_nameJob name"trivy:scan:rootfs"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_ROOTFS_PATHRoot filesystem path"/"
TRIVY_SCANNERSScanners"vuln,secret"
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail job on findingstrue
TRIVY_IGNORE_UNFIXEDIgnore unfixedtrue
TRIVY_PKG_TYPESPackage types"os,library"
TRIVY_TIMEOUTTimeout"10m"
TRIVY_SKIP_FILESFiles to skip""
TRIVY_SKIP_DIRSDirectories to skip""
TRIVY_EXTRA_ARGSExtra args""
TRIVY_REPORT_BASENAMEArtifact basename"rootfs-scan"
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_rootfs@latest
    inputs:
      TRIVY_ROOTFS_PATH: "/mnt/root"
      TRIVY_SCANNERS: "vuln"

Component: templates/target_repository.yml

InputDescriptionDefault
job_nameJob name"trivy:scan:repo"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_REPO_TARGETLocal path or Git URL"."
TRIVY_REPO_BRANCHRemote branch""
TRIVY_REPO_COMMITCommit hash""
TRIVY_REPO_TAGTag name""
TRIVY_SCANNERSScanners"vuln,secret"
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail job on findingstrue
TRIVY_IGNORE_UNFIXEDIgnore unfixedtrue
TRIVY_TIMEOUTTimeout"10m"
TRIVY_SKIP_FILESFiles to skip""
TRIVY_SKIP_DIRSDirs to skip""
TRIVY_EXTRA_ARGSExtra args""
TRIVY_REPORT_BASENAMEArtifact basename"repo-scan"
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_repository@latest
    inputs:
      TRIVY_REPO_TARGET: "https://github.com/aquasecurity/trivy"
      TRIVY_REPO_BRANCH: "main"

Component: templates/target_vm.yml

InputDescriptionDefault
job_nameJob name"trivy:scan:vm"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_VM_TARGETLocal path or ami:/ebs: identifier""
TRIVY_AWS_REGIONAWS region for AMI/EBS scans""
TRIVY_SCANNERSScanners"vuln"
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail job on findingstrue
TRIVY_IGNORE_UNFIXEDIgnore unfixedtrue
TRIVY_TIMEOUTTimeout"20m"
TRIVY_EXTRA_ARGSExtra args""
TRIVY_REPORT_BASENAMEArtifact basename"vm-scan"
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_vm@latest
    inputs:
      TRIVY_VM_TARGET: "ami-0123456789abcdef0"
      TRIVY_AWS_REGION: "us-east-1"

Component: templates/target_kubernetes.yml

InputDescriptionDefault
job_nameJob name"trivy:scan:k8s"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_K8S_OBJECTScope (cluster, namespace/foo, etc.)""
TRIVY_K8S_REPORTReport detail (summary/all)"summary"
TRIVY_K8S_KUBECONFIGCustom kubeconfig path""
TRIVY_K8S_INCLUDE_NAMESPACESNamespaces to include""
TRIVY_K8S_EXCLUDE_NAMESPACESNamespaces to exclude""
TRIVY_K8S_INCLUDE_KINDSKinds to include""
TRIVY_K8S_EXCLUDE_KINDSKinds to exclude""
TRIVY_K8S_SKIP_IMAGESSkip workload image scansfalse
TRIVY_K8S_DISABLE_NODE_COLLECTORDisable node collectorfalse
TRIVY_SCANNERSScanners"vuln,misconfig,secret"
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail job on findingstrue
TRIVY_IGNORE_UNFIXEDIgnore unfixedtrue

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/target_kubernetes@latest
    inputs:
      TRIVY_K8S_OBJECT: "namespace/prod"
      TRIVY_K8S_REPORT: "summary"

Component: templates/scanner_iac_config.yml

InputDescriptionDefault
job_nameJob name"trivy:scan:iac"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_CONFIG_PATHIaC directory"."
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail on findingstrue
TRIVY_CONFIG_REPORTReport detail"all"
TRIVY_CONFIG_INCLUDE_NON_FAILURESInclude passesfalse
TRIVY_MISCONFIG_SCANNERSMisconfig scanners list"azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform"
TRIVY_TIMEOUTTimeout"10m"
TRIVY_SKIP_FILESFiles to skip""
TRIVY_SKIP_DIRSDirs to skip""
TRIVY_CONFIG_EXTRA_ARGSExtra args""
TRIVY_REPORT_BASENAMEArtifact basename"iac-scan"
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/scanner_iac_config@latest
    inputs:
      TRIVY_CONFIG_PATH: "examples/iac/terraform"
      severity: "CRITICAL,HIGH,MEDIUM"

Component: templates/scanner_license.yml

InputDescriptionDefault
job_nameJob name"trivy:scan:license"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_SCAN_REMOTE_IMAGERemote image ref""
TRIVY_SCAN_LOCAL_IMAGESLocal tar/OCI or filesystem path""
TRIVY_SCANNERSScanner list"license"
severitySeverities"CRITICAL"
exit_on_vulnerabilityFail on severity matchtrue
TRIVY_LICENSE_FULLEnable --license-fullfalse
TRIVY_LICENSE_CONFIDENCEConfidence threshold"0.9"
TRIVY_LICENSE_IGNOREDLicenses to ignore""
TRIVY_PKG_TYPESPackage types"os,library"
TRIVY_TIMEOUTTimeout"10m"
TRIVY_EXTRA_ARGSExtra args""
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/scanner_license@latest
    inputs:
      TRIVY_SCAN_LOCAL_IMAGES: "test.tar"
      TRIVY_LICENSE_FULL: true

Component: templates/sbom_generate_image.yml

InputDescriptionDefault
job_nameJob name"trivy:sbom:image"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_SBOM_IMAGERemote image ref""
TRIVY_SBOM_INPUTLocal OCI/tar input""
TRIVY_SBOM_FORMATSBOM format"cyclonedx"
TRIVY_SBOM_FILENAMEOutput filename"image-sbom.cdx.json"
TRIVY_SBOM_EXTRA_ARGSExtra args""
TRIVY_TIMEOUTTimeout"10m"
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/sbom_generate_image@latest
    inputs:
      TRIVY_SBOM_INPUT: "test.tar"
      TRIVY_SBOM_FILENAME: "ci-image-sbom.cdx.json"

Component: templates/sbom_generate_repo.yml

InputDescriptionDefault
job_nameJob name"trivy:sbom:repo"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_REPO_TARGETPath or remote Git URL"."
TRIVY_REPO_BRANCHBranch""
TRIVY_REPO_COMMITCommit hash""
TRIVY_REPO_TAGTag""
TRIVY_SBOM_FORMATFormat"cyclonedx"
TRIVY_SBOM_FILENAMEOutput filename"repo-sbom.cdx.json"
TRIVY_REPO_SCANNERSScanners during SBOM creation"vuln,secret"
TRIVY_REPO_EXTRA_ARGSExtra args""
TRIVY_TIMEOUTTimeout"10m"
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/sbom_generate_repo@latest
    inputs:
      TRIVY_REPO_TARGET: "."
      TRIVY_SBOM_FORMAT: "spdx-json"

Component: templates/sbom_generate_kbom.yml

InputDescriptionDefault
job_nameJob name"trivy:sbom:kbom"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_K8S_TARGETtrivy k8s target (cluster, namespace/...)"cluster"
TRIVY_K8S_CONTEXTKubeconfig context""
TRIVY_K8S_EXTRA_ARGSExtra args""
TRIVY_SBOM_FILENAMEKBOM filename"kbom.cdx.json"
TRIVY_TIMEOUTTimeout"15m"
scan_kbomRun vulnerability scan on generated KBOMtrue
TRIVY_SBOM_SCANNERSScanners for KBOM scan"vuln"
severitySeverities for KBOM scan"CRITICAL,HIGH"
exit_on_vulnerabilityFail on findingstrue
TRIVY_SBOM_SCAN_EXTRA_ARGSExtra args for KBOM scan""
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/sbom_generate_kbom@latest
    inputs:
      TRIVY_K8S_TARGET: "namespace/default"
      scan_kbom: true

Component: templates/sbom_scan_file.yml

InputDescriptionDefault
job_nameJob name"trivy:scan:sbom"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_SBOM_PATHPath to SBOM file"artifacts/trivy/image-sbom.cdx.json"
TRIVY_SBOM_REPORT_BASENAMEOutput basename"sbom-scan"
TRIVY_SCANNERSScanners to run"vuln,license"
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail on findingstrue
TRIVY_SBOM_SCAN_EXTRA_ARGSExtra args""
TRIVY_TIMEOUTTimeout"10m"
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/sbom_scan_file@latest
    inputs:
      TRIVY_SBOM_PATH: "artifacts/trivy/ci-image-sbom.cdx.json"
      TRIVY_SCANNERS: "vuln,license"

Component: templates/sbom_scan_rekor.yml

InputDescriptionDefault
job_nameJob name"trivy:scan:rekor"
stageStage"test"
imageTrivy image"ghcr.io/aquasecurity/trivy:0.68.1"
TRIVY_SCAN_REMOTE_IMAGEAttested remote image""
TRIVY_REKOR_URLRekor API endpoint""
TRIVY_SCANNERSScanners"vuln"
severitySeverities"CRITICAL,HIGH"
exit_on_vulnerabilityFail on findingstrue
TRIVY_IGNORE_UNFIXEDIgnore unfixedtrue
TRIVY_TIMEOUTTimeout"10m"
TRIVY_EXTRA_ARGSExtra args""
allow_failureAllow failurefalse

Example

root@kitploit:~
include:
  - component: $CI_SERVER_FQDN/niclas-zone/ci/trivy/sbom_scan_rekor@latest
    inputs:
      TRIVY_SCAN_REMOTE_IMAGE: "registry.gitlab.com/group/app@sha256:..."
      TRIVY_REKOR_URL: "https://rekor.sigstore.dev"
File glob exclusions
""
TRIVY_SKIP_DIRSDirectory exclusions""
allow_failureAllow failure without failing pipelinefalse
TRIVY_TIMEOUTTimeout"15m"
TRIVY_K8S_EXTRA_ARGSExtra args""
TRIVY_REPORT_BASENAMEArtifact basename"k8s-scan"
allow_failureAllow failurefalse