Trivy Integration Guide

Integrate Trivy with Vulnetix. Scan containers, filesystems, git repos, and infrastructure code for vulnerabilities, misconfigurations, secrets, and licenses.

Install & scan

$ curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
$ trivy fs . --format sarif --output trivy.sarif

Run Trivy in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install Trivy
  run: |
    curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
- name: Run Trivy
  run: trivy fs . --severity CRITICAL,HIGH --format sarif --output trivy.sarif
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: trivy
    path: trivy.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Trivy's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Trivy. Keep running it. Vulnetix sits on top of Trivy (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Trivy is strongest at its core category and also carries features in SCA, IaC & Cloud Configuration, Secret Scanning, License Compliance, SBOM Generation, Cloud Security & CSPM, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Trivy does well

• Free, open-source single binary that scans images, filesystems, git repos, K8s clusters and IaC with one command, a dominant CI/CD default
• Broad OS + language-dependency vuln coverage across many distros and ecosystems, fast and offline-capable
• Generates and scans CycloneDX and SPDX SBOMs, and can consume VEX documents to filter noise
• All-in-one target coverage: vulns, IaC misconfig, secrets and license checks in the same tool

Where Vulnetix adds to it: Trivy is the open-source scanner; Vulnetix ingests its output and layers on cross-scanner dedup into one prioritised queue, exploit-intel scoring (EPSS/KEV/LEV), reachability, immutable versioned VEX + audit, and Safe Harbour autofix, capabilities Trivy leaves to the platform above it.

No migration, no rip-and-replace. Trivy keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Trivy results in Vulnetix

Upload Trivy SARIF, CycloneDX, SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Trivy documentation ↗  ·  Source repository ↗

Wire Trivy into your CI/CD pipeline →