Dependency Vulnerability Scanning in CI with Grype, Trivy, and OSV-Scanner

# Scan a container image
grype myapp:latest

<span class="hljs-comment"># Scan local directory
grype <span class="hljs-built_in">dir:.

<span class="hljs-comment"># Scan a pre-generated SBOM
grype sbom:sbom.spdx.json

<span class="hljs-comment"># Fail on high+ severity
grype myapp:latest --fail-on high

<span class="hljs-comment"># JSON output for processing
grype myapp:latest -o json <span class="hljs-pipe">| jq <span class="hljs-string">'.matches[] | {name: .artifact.name, severity: .vulnerability.severity, fixed: .vulnerability.fix.versions}'

# .grype.yaml
fail-on-severity: high
only-fixed: false

# Suppress known false positives or accepted risks
ignore:
  - vulnerability: CVE-2023-XXXX
    package:
      name: some-lib
  - fix-state: not-fixed  # suppress unfixable vulns

output: table

db:
  auto-update: true
  validate-age: true
  # Max age of DB before refusing to scan (safety check)
  max-allowed-built-age: "120h"

# Speed up repeated scans
check-for-app-update: false

- name: Vulnerability scan with Grype
  uses: anchore/scan-action@v3
  with:
    image: myapp:${{ github.sha }}
    fail-build: true
    severity-cutoff: high
    output-format: sarif  # Uploads to GitHub Security tab

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: results.sarif

# Scan a container image
trivy image myapp:latest

<span class="hljs-comment"># Scan a local filesystem
trivy fs /path/to/project

<span class="hljs-comment"># Scan a git repository
trivy repo https://github.com/myorg/myrepo

<span class="hljs-comment"># Scan Kubernetes cluster
trivy k8s --report=summary cluster

<span class="hljs-comment"># Scan IaC configs
trivy config ./terraform

<span class="hljs-comment"># Fail on critical only
trivy image --exit-code 1 --severity CRITICAL myapp:latest

<span class="hljs-comment"># Fail on high+
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest

# Scan with SARIF output
trivy image --format sarif --output trivy-results.sarif myapp:latest

<span class="hljs-comment"># CycloneDX SBOM output
trivy image --format cyclonedx --output sbom.cdx.json myapp:latest

<span class="hljs-comment"># Skip update check (faster in offline CI)
trivy image --skip-update myapp:latest

<span class="hljs-comment"># Use cached DB (pre-download in CI)
trivy image --cache-dir /opt/trivy-db myapp:latest

<span class="hljs-comment"># Ignore unfixed vulnerabilities
trivy image --ignore-unfixed myapp:latest

<span class="hljs-comment"># Only scan specific vulnerability types
trivy image --vuln-type os,library myapp:latest

# trivy.yaml
severity:
  - HIGH
  - CRITICAL

exit-code: 1
ignore-unfixed: true

# Ignore specific CVEs
ignorefile: .trivyignore

vulnerability:
  type:
    - os
    - library

scan:
  security-checks:
    - vuln
    - secret
    - config

# .trivyignore
# CVE-2022-1234 - False positive, not affected by this code path
CVE-2022-1234

# CVE-2023-5678 - Accepted risk, no fix available, mitigated by WAF
CVE-2023-5678

- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: myapp:${{ github.sha }}
    format: sarif
    output: trivy-results.sarif
    exit-code: 1
    severity: HIGH,CRITICAL
    ignore-unfixed: true

- name: Upload Trivy SARIF
  uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: trivy-results.sarif

- name: Cache Trivy DB
  uses: actions/cache@v4
  with:
    path: ~/.cache/trivy
    key: trivy-db-${{ github.run_id }}
    restore-keys: trivy-db-

- name: Update Trivy DB
  run: trivy image --download-db-only

- name: Scan image
  run: trivy image --skip-update myapp:latest

# Go install
go install github.com/google/osv-scanner/cmd/osv-scanner@latest

<span class="hljs-comment"># Homebrew
brew install osv-scanner

<span class="hljs-comment"># Docker
docker pull ghcr.io/google/osv-scanner

# Scan current directory (finds lock files automatically)
osv-scanner .

<span class="hljs-comment"># Scan specific lock file
osv-scanner --lockfile package-lock.json

<span class="hljs-comment"># Scan multiple lock files
osv-scanner --lockfile package-lock.json --lockfile requirements.txt

<span class="hljs-comment"># Scan container image
osv-scanner --docker myapp:latest

<span class="hljs-comment"># Scan git repository (including commit history)
osv-scanner -r .

<span class="hljs-comment"># Scan SBOM
osv-scanner --sbom sbom.cdx.json

<span class="hljs-comment"># JSON output
osv-scanner --format json . <span class="hljs-pipe">| jq .

# Go
osv-scanner --lockfile go.sum

<span class="hljs-comment"># Node.js
osv-scanner --lockfile package-lock.json
osv-scanner --lockfile yarn.lock
osv-scanner --lockfile pnpm-lock.yaml

<span class="hljs-comment"># Python
osv-scanner --lockfile requirements.txt
osv-scanner --lockfile Pipfile.lock
osv-scanner --lockfile poetry.lock

<span class="hljs-comment"># Ruby
osv-scanner --lockfile Gemfile.lock

<span class="hljs-comment"># Rust
osv-scanner --lockfile Cargo.lock

<span class="hljs-comment"># PHP
osv-scanner --lockfile composer.lock

- name: Run OSV-Scanner
  uses: google/osv-scanner-action@v1
  with:
    scan-args: |-
      --lockfile=package-lock.json
      --lockfile=requirements.txt
      --format=sarif
      --output=osv-results.sarif

- name: Upload OSV SARIF
  uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: osv-results.sarif

# Get remediation suggestions
osv-scanner --format table --experimental-guided-remediation .

scan-all:
  runs-on: ubuntu-latest
  steps:
    - name: Build image
      run: docker build -t myapp:${{ github.sha }} .

    - name: Grype scan
      uses: anchore/scan-action@v3
      with:
        image: myapp:${{ github.sha }}
        severity-cutoff: critical
        fail-build: false  # Collect all results, fail later
        output-format: sarif
      
    - name: Trivy scan
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: myapp:${{ github.sha }}
        severity: CRITICAL
        exit-code: 0
        format: sarif
        output: trivy-results.sarif

    - name: OSV-Scanner
      run: |
        osv-scanner --docker myapp:${{ github.sha }} \
          --format sarif \
          --output osv-results.sarif || true

    # Now fail if any scanner found criticals
    - name: Check results
      run: |
        GRYPE_CRITICALS=$(jq '[.runs[].results[] | select(.level == "error")] | length' grype-results.sarif)
        TRIVY_CRITICALS=$(jq '[.runs[].results[] | select(.level == "error")] | length' trivy-results.sarif)
        if [ "$GRYPE_CRITICALS" -gt 0 ] || [ "$TRIVY_CRITICALS" -gt 0 ]; then
          echo "Critical vulnerabilities found"
          exit 1
        fi

# Generate baseline
grype myapp:latest -o json > baseline.json

<span class="hljs-comment"># In CI: fail only if new vulnerabilities vs baseline
grype myapp:latest -o json > current.json
python3 check-new-vulns.py baseline.json current.json

# check-new-vulns.py
import json
import sys

def get_vuln_ids(data):
    return {m['vulnerability']['id'] for m in data.get('matches', [])}

with open(sys.argv[1]) as f:
    baseline = get_vuln_ids(json.load(f))

with open(sys.argv[2]) as f:
    current = get_vuln_ids(json.load(f))

new_vulns = current - baseline
if new_vulns:
    print(f"New vulnerabilities introduced: {new_vulns}")
    sys.exit(1)
print("No new vulnerabilities")