Q: Your security team discovers that developer container images running in production contain unpatched Critical CVEs and run as root with dangerous capabilities. How do you implement Aqua Trivy in CI/CD pipelines to scan container images and Dockerfiles, block builds with Critical fixable vulnerabilities, and export SARIF reports directly to GitHub Security?

Scan newly built container images before pushing to registries:

• Trivy Image Scan: Executed trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 payment-service:latest.
• Ignore Unfixed CVEs: Setting --ignore-unfixed ensures the build fails only if a patched version of the vulnerable package actually exists in upstream repositories.

Catch insecure container configurations before image compilation:

• Config Scanning: Executed trivy config ./Dockerfile.
• Policy Checks: Trivy checks for compliance against CIS Docker Benchmarks: catching missing USER instructions (running as root), exposed sensitive ports, and missing health checks.
• Secret Scanning: Scans the repository and image filesystem for leaked API keys, tokens, and private SSH certificates.

Integrate findings natively into GitHub Advanced Security dashboards:

• SARIF Export: Executed trivy image --format sarif --output trivy-results.sarif payment-service:latest.
• Upload Action: Integrated github/codeql-action/upload-sarif@v3 with: { sarif_file: 'trivy-results.sarif' }.
• GitHub Security Alerts: Vulnerabilities display directly in the GitHub repository's Security tab with remediation advice.

Accelerate scanning speed by caching the vulnerability database:

• DB Cache Sharing: Configured CI cache for ~/.cache/trivy, downloading differential DB updates in 4 seconds instead of 45 seconds.
• Private Registry Push: Only images that pass 100% of Trivy gates are tagged and pushed to the enterprise container registry.