Trivy component

This component executes Trivy vulnerability and misconfiguration scans against container images or filesystem paths and produces machine-readable reports.

Every container image scan also applies the bundled CRITICAL entitlement policy. Images containing files below /etc/pki/entitlement are rejected so Red Hat subscription certificates and keys cannot be distributed in image layers. This policy remains active when the scanners input omits secret. Set the string input secret-config to other Trivy secret configuration contents to apply a project-specific policy instead.

By default, vulnerabilities without an available fix are excluded. Set the ignore-unfixed input to false to include them.

Set CI_TRIVIY_SERVER_URL to a Trivy server URL, including the http:// or https:// scheme, to run vulnerability and license scanning in client/server mode. The component passes the URL to every image or filesystem scan with Trivy's --server option.

Scans do not run for the renovate/gitlab-pipelines branch, including merge request pipelines for that branch. This branch is generated by the gitlab-pipelines package rule in the shared Renovate configuration. The rules input continues to control all other pipeline contexts.

Variables

Name	required	Hints
TRIVY_TIMEOUT	no	Global variable to set a custom scan timeout for long running scans
CI_TRIVIY_SERVER_URL	no	Trivy server URL used for client/server scans

Usage

Scan the filesystem

• Create a new pipeline file

include:
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/tivy@stable
  inputs:
    name: project
    path: .

Scan a container image

• Create a new pipeline file

include:
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/tivy@stable
  inputs:
    name: image
    image: registry.gitlab.com/xrow-public/ci-tools/test-insecure-java-app:latest
    ignore-unfixed: false

Inputs

Name	Description	Default	Type
---	---	---	---
dependencies	The dependencies that this job depends on.	[]	array
ignore-unfixed	Exclude vulnerabilities that do not have a fix available.	true	boolean
image	Url to the image.		string
name	Name for the pipeline jobs and the container.	$CI_PROJECT_NAME	string
needs	The jobs that this job depends on.	[]	array
package-types	Package types to scan	["os","library"]	array
path	Path to the sources.	.	string
rules	The jobs that this job depends on.	[{"if":"$CI_PIPELINE_SOURCE == \"schedule\"","when":"never"},{"if":"$CI_PIPELINE_SOURCE == \"merge_request_event\"","when":"on_success"},{"when":"on_success"}]	array
scanners	Scanners to use. none, vuln, license, secret, misconfig	["vuln","secret","license","misconfig"]	array
scanning-allow-failure	Should the pipeline fail if scanning the built container image fails?	true	boolean
scanning-severity	What level of severity should cause scanning of the built container to fail?	CRITICAL	string
scanning-timeout	How long should the scanning process be allowed to run before timing out? Use format e.g. 5m0s		string
secret-config	Trivy secret scanner configuration used for image scans.	rules: - id: redhat-entitlement-material category: subscription title: Red Hat entitlement material must not be shipped in container images severity: CRITICAL path: '(^|/)etc/pki/entitlement/.+' regex: '(?s).+'	string
stage	The pipeline stage that the jobs belongs to.	build	string
tags	The runners that this job depends on.	[]	array