Originally announced October 7, 2020. Source: Security Boulevard.
Trivy Comes to GitHub Actions
Aqua Security announced that its popular open-source vulnerability scanner, Trivy, is now available as an official Aqua Security Trivy GitHub Action. The integration connects Trivy directly to GitHub’s native code scanning feature, allowing development teams to embed container image scanning into their existing GitHub Actions workflows without leaving the GitHub interface.
The goal is straightforward: surface known vulnerabilities before container images reach production, while keeping friction for developers as low as possible.
What the Trivy GitHub Action Does
The Trivy Action scans a container image for:
- OS package vulnerabilities — known CVEs in base image packages (e.g., Debian, Alpine, RHEL-based layers).
- Language library vulnerabilities — CVEs in application dependencies such as npm, pip, gem, Maven, and Go modules bundled inside the image.
When a vulnerability is found, the action surfaces an alert directly in the GitHub user interface, so developers can act on it immediately — updating a dependency or pinning a safer base image — without switching to a separate security tool or dashboard.
Integration with GitHub Code Scanning via SARIF
A key technical detail is how the results are delivered. The Trivy Action outputs findings in SARIF (Static Analysis Results Interchange Format), the standard format GitHub’s code scanning API accepts for ingesting security tool output. This means scan results appear natively under a repository’s Security tab, alongside other code scanning alerts, rather than in an external report.
GitHub code scanning also integrates with pull requests, so teams can configure policies that block or warn when a PR introduces a new high-severity CVE — keeping the security feedback loop tight and developer-friendly.
Example Workflow
A typical use case is building a container image from a Dockerfile in a repository and then running the Trivy Action against it as part of the same CI pipeline. A simplified GitHub Actions workflow looks like this:
name: Container Image Scan
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
jobs:
trivy-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Build container image
run: docker build -t my-app:${{ github.sha }} .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: my-app:${{ github.sha }}
format: sarif
output: trivy-results.sarif
severity: CRITICAL,HIGH
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: trivy-results.sarif
Code language: HTTP (http)This workflow builds the image, scans it with Trivy, and uploads the SARIF results to GitHub’s Security tab — all within a single automated pipeline step.
Why This Matters for DevOps and Platform Teams
Container image scanning is a well-established DevSecOps practice, but adoption often stalls when it requires developers to learn separate tools, log in to separate dashboards, or wait for security teams to review results. By meeting developers where they already work — inside GitHub — the Trivy Action reduces the barrier to integrating security into the software development lifecycle.
Key benefits for engineering teams include:
- Shift-left security: Vulnerabilities are caught at the PR stage, not after deployment.
- No additional tooling overhead: Trivy is open-source and the GitHub Action requires no Aqua Security account or license.
- Native GitHub UX: Results appear in the Security tab, actionable alongside code review comments.
- SARIF compatibility: Output integrates with GitHub’s standard code scanning API, making it easy to combine with other SAST or SCA tools.
- Policy enforcement: Teams can configure branch protection rules to block merges when critical CVEs are detected.
Availability
The Aqua Security Trivy GitHub Action is available on the GitHub Marketplace. The underlying Trivy scanner is open-source and maintained on GitHub under the aquasecurity organization.
About Aqua Security
Aqua Security is a cloud-native security company whose platform covers the full application lifecycle — from build-time scanning to runtime protection of containers, serverless functions, and cloud VMs. Trivy is one of several open-source projects Aqua maintains for the broader DevSecOps community. More information is available at aquasec.com.