Trivy as a CI gate: scan, fail on severity, ticket the rest

Trivy, the open-source scanner maintained by Aqua Security, has become a default choice for catching known vulnerabilities, misconfigurations, exposed secrets and missing SBOMs before a container image or infrastructure-as-code change reaches production. For managed service providers running many customer pipelines, the value is less about the tool itself and more about how consistently it gates the build.

The pattern: scan, fail, ticket

The durable version of this workflow is simple to describe and easy to skip under deadline pressure: scan on every pipeline run, fail the job when findings cross an agreed severity threshold — typically high or critical — and open or update a ticket with the CVE summary, image digest and an owner. Promotion to production stays blocked until the finding is fixed or formally risk-accepted by someone with the authority to accept it.

Making the gate operational

• Pin a specific Trivy version in CI rather than always pulling latest, so a database update cannot silently change build outcomes.
• Scan the built image or lockfile, not just the source tree, so transitive dependencies are covered.
• Exit non-zero on the agreed severity threshold and fail the pipeline job.
• Post results to the issue tracker the team already uses, tagged with the image digest and owner.
• Require an explicit, logged acknowledgement for any risk-accepted exception.

Trivy can also generate SBOMs in SPDX or CycloneDX format as part of the same run, giving MSPs build evidence they can hand to a customer or auditor without a separate tool.

What the gate does not cover

A clean scan attests to known issues in that artifact at that moment — it does not replace image signing, admission control or runtime detection, and it says nothing about a zero-day. Secret scanning belongs alongside vulnerability scanning as routine hygiene, not as a stand-in for patch service-level agreements.

Getting the basics right — a pinned scanner version, a clear severity threshold and a ticket trail — matters more for most fleets than chasing every new scanning feature.

Sources: GitHub — aquasecurity/trivy, Trivy documentation.