Trivy Infrastructure Security Scanning Implementation

Overview

This document details the implementation of Trivy infrastructure and container security scanning using the reviewdog/action-trivy action. Trivy is a comprehensive security scanner that identifies vulnerabilities in OS packages, application dependencies, and infrastructure configurations.

Implementation Details

Workflow: .github/workflows/trivy.yml

The Trivy workflow implements dual-job security scanning:

1. trivy-config: Scans infrastructure configuration files
2. trivy-filesystem: Scans application dependencies and filesystem

Features

trivy-config Job

• Purpose: Infrastructure configuration security scanning
• Scan Types:
  • Dockerfile security analysis
  • Docker Compose configuration review
  • Kubernetes manifest scanning
  • Terraform configuration analysis
• Target Files:
  • Dockerfile* - All Dockerfile variants
  • docker-compose*.yml - Docker Compose configurations
  • *.k8s.yaml - Kubernetes manifests
  • *.tf - Terraform files

trivy-filesystem Job

• Purpose: Application dependency vulnerability scanning
• Scan Types:
  • Ruby Gemfile dependency analysis
  • Node.js package.json scanning
  • Python requirements.txt analysis
  • Go module vulnerability detection
• Target Files:
  • Gemfile* - Ruby dependencies
  • package*.json - Node.js dependencies
  • requirements*.txt - Python dependencies
  • go.mod/go.sum - Go modules

Security Coverage

Infrastructure Files Scanned

Dockerfile.prod              # Production optimized image
Dockerfile.stage              # Staging optimized image
.devcontainer/Dockerfile      # Development container

Dependency Files Scanned

Gemfile / Gemfile.lock        # Ruby gems
package.json / yarn.lock      # Node.js packages
requirements.txt              # Python packages (if present)

Workflow Configuration

Triggers

• Push: All branches
• Pull Request: All PRs
• Manual: workflow_dispatch

Smart File Detection

• Uses tj-actions/changed-files for efficient scanning
• Only scans modified infrastructure and dependency files
• Optimized for large repositories

reviewdog Integration

• Reporter: github-pr-review
• Fail on Error: true
• Filter Mode: nofilter (scan all findings)
• Level: error (treat vulnerabilities as errors)

Security Levels

Infrastructure Config Scanning

• Severity Levels: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
• Policy Types:
  • Docker best practices
  • Security misconfigurations
  • Resource limits
  • Access controls

Filesystem Vulnerability Scanning

• Severity Levels: MEDIUM,HIGH,CRITICAL (excludes LOW)
• Vulnerability Types:
  • Known CVEs in dependencies
  • Outdated packages
  • Security advisories
  • License compliance issues

Comparison with Existing Tools

Security Pipeline Integration

Trivy vs Existing Solutions

Infrastructure Security (NEW CAPABILITY)

• Before: No infrastructure configuration scanning
• After: Comprehensive Docker, K8s, Terraform analysis
• Gap Filled: Container security misconfigurations

Dependency Scanning Enhancement

• Before: Limited to Bundler-audit (Ruby only)
• After: Multi-language dependency scanning
• Improvement: Node.js, Python, Go vulnerability detection

Repository Analysis

Infrastructure Files Discovered

# Dockerfiles (3 found)
./Dockerfile.prod
./Dockerfile.stage
./.devcontainer/Dockerfile

# Docker Compose (3 found)
./docker-compose.yml
./docker-compose.test.yml
./docker-compose-unit-test.yml

Dependency Files Present

# Ruby Dependencies
./Gemfile
./Gemfile.lock

# Node.js Dependencies
./package.json
# yarn.lock (if present)

# Build Configuration
./babel.config.js
./jest.config.js
./postcss.config.js

Validation Results

act Testing

# Workflow validation
✅ act --validate
✅ act -n -j trivy-config
✅ act -n -j trivy-filesystem

# Total workflows: 16
# All workflows validated successfully

Workflow Structure

Infrastructure Security Scanning:
├── trivy-config (Infrastructure Config Security Scan)
│   ├── Checkout Repository
│   ├── Get changed infrastructure files
│   └── Run Trivy config scan with reviewdog
└── trivy-filesystem (Filesystem Security Scan)
    ├── Checkout Repository
    ├── Get changed application files
    └── Run Trivy filesystem scan with reviewdog

Benefits

Security Enhancements

1. Infrastructure Security: First-time container and config scanning
2. Multi-Language Support: Beyond Ruby to Node.js, Python, Go
3. Early Detection: Catch vulnerabilities in PR reviews
4. Comprehensive Coverage: OS packages + app dependencies

Developer Experience

1. GitHub PR Integration: Inline security feedback
2. Smart Scanning: Only scan changed files
3. Clear Reporting: Severity-based issue categorization
4. Non-Blocking: Optional enforcement levels

DevOps Integration

1. Self-Hosted Runners: Optimized for internal infrastructure
2. Efficient Execution: Conditional job execution
3. Scalable Design: Handles large repositories
4. Monitoring Ready: Structured logging and reporting

Configuration Details

File Patterns Monitored

Infrastructure Config Files

files: |
  Dockerfile*
  docker-compose*.yml
  *.k8s.yaml
  *.tf
  buildspec*.yml
  .dockerignore

Application Dependency Files

files: |
  Gemfile*
  package*.json
  yarn.lock
  requirements*.txt
  go.mod
  go.sum

Trivy Action Parameters

Config Scanning

scan-type: "config"
format: "sarif"
template: "@/contrib/sarif.tpl"
exit-code: "1"
ignore-unfixed: true
severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"

Filesystem Scanning

scan-type: "filesystem"
format: "sarif"
template: "@/contrib/sarif.tpl"
exit-code: "1"
ignore-unfixed: true
severity: "MEDIUM,HIGH,CRITICAL"

Best Practices

Security Implementation

1. Fail Fast: Set exit-code: 1 for critical vulnerabilities
2. Ignore Unfixed: Focus on actionable vulnerabilities
3. Severity Filtering: Prioritize HIGH/CRITICAL issues
4. Regular Updates: Keep Trivy database current

Performance Optimization

1. Changed Files Only: Scan modified files for efficiency
2. Parallel Jobs: Independent config and filesystem scanning
3. Conditional Execution: Skip when no relevant files changed
4. Resource Limits: Appropriate for self-hosted runners

Maintenance

Regular Tasks

1. Monthly: Review and update severity thresholds
2. Quarterly: Evaluate new Trivy scan types and features
3. As Needed: Adjust file patterns for new infrastructure
4. Continuous: Monitor scan results and tune false positives

Updates

• Trivy action updates automatically with @master pin
• Database updates handled by Trivy automatically
• Monitor reviewdog/action-trivy releases

Troubleshooting

Common Issues

1. Large Scan Times: Use file filtering and changed-files detection
2. False Positives: Adjust severity levels and ignore patterns
3. Runner Capacity: Monitor self-hosted runner resources
4. Network Issues: Ensure Trivy database access

Debug Commands

# Test locally with act
act -n -j trivy-config
act -n -j trivy-filesystem

# Manual Trivy scan
trivy config .
trivy filesystem .

Integration Status

Implementation Date: January 2025
Trivy Action Version: v1.13.10
Status: Production Ready ✅