Trivy

A plugin to find vulnerabilities, misconfigurations, secrets, SBOM and more.

The below pipeline configuration demonstrates simple usage:

pipeline:
  scan_vuln:
    image: woodpeckerci/plugin-trivy

Settings

Settings Name	Default	Description
exit-code	1	if an issue is detected let the step fail
skip-dirs	vendor,node_modules	folders excluded from scan
dir	.	root folder to scan from
server	none	use a trivy server, can be a service step or extern
severity	none	severities of security issues to be displayed (comma separated) (default "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL")