A software vulnerability is a weakness that can compromise security properties when exploited. In CI/CD, treat known vulnerabilities as release risks: scan code, container images, and dependencies before they reach production. section 8.3.4 section 8.5.4 section 10.4
Security scanning should run on pull requests to prevent new findings from entering the main branch, on pushes to assess changed software, and on a schedule because new ecosystem vulnerabilities can emerge without code changes. A workflow can block release until findings at a chosen severity are mitigated. section 8.3.4 section 8.6.3
Scan the main vulnerability surfaces in an automated workflow:
- Source code: use SAST or DAST tooling, such as GitHub Advanced Security and CodeQL, to report known vulnerabilities to the security dashboard. section 8.3.4 section 8.6.3
- Container images: scan the built image before pushing it to a registry; fail the workflow for Critical or High findings to keep vulnerable artifacts out of downstream environments. section 8.5.4
- Dependencies: inspect the dependency graph for vulnerable packages and update or accept generated pull requests for secure versions. section 10.4
Fail a container build on severe findings
Add a Trivy step after building the image and before publishing it. Set severity to CRITICAL,HIGH and exit-code to 1 so the workflow stops when either level is detected. This shifts security checks left, when remediation is less likely to expose a vulnerable image to an environment. section 8.5.4
Listing 8.11 Adding a container image scanning step
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: '${{env.containerRegistry}}/${{env.imageRepository}}:${{github.run_number}}'
format: 'table'
severity: 'CRITICAL,HIGH'
exit-code: '1'
Use the listing as a minimal GitHub Actions step for scanning a tagged container image and enforcing a severity threshold. section 8.5.4
For consolidated reporting, configure container scanning to emit SARIF and upload the result to the GitHub Security tab. Findings may point to remediation choices such as replacing a vulnerable base image; dependency alerts may provide a pull request when a nonvulnerable package version is available. section 8.6.3 section 10.4
