Trivy

Vulnerabilities & IaC · Any stack · stage: vuln-scan

Dependency CVEs and Terraform, Docker, and Kubernetes misconfigurations, caught pre-merge.

Agents add dependencies and edit infrastructure files without a security reviewer looking over their shoulder. The Trivy plugin gives every session a vuln-scan stage: one scan of the agent’s worktree that covers known CVEs in dependency lockfiles and misconfigurations in Terraform, Dockerfiles, Kubernetes manifests, and other IaC.

Trivy absorbed tfsec, so Terraform checks are included — one binary and one stage cover what used to take three tools.

What it installs

A vuln-scan test stage registered in .har/stages.json and added to verificationStages.
A .trivyignore scaffold for documented suppressions that travel with the change batch.
A GitHub Actions workflow that uploads SARIF to GitHub code scanning (skip with --skip-ci).

Requirements

The trivy binary (brew install trivy) — the stage fails fast with an install hint when missing

Artifacts & evidence

JSON reports and a readable summary land under .har/artifacts/vuln-scan/. The vulnerability database is cached once per machine (TRIVY_CACHE_DIR), so repeat runs finish in about a second.

Adapting it to your repo

The fail threshold defaults to HIGH,CRITICAL — tune HARNESS_TRIVY_SEVERITY and HARNESS_TRIVY_SCANNERS in .har/harness.env.
See .har/stages/TRIVY.md for container image scanning and monorepo scoping.

CI & compliance

The local stage is pre-merge shift-left; the CI workflow feeds GitHub code scanning — the org-level evidence layer that compliance platforms such as Vanta ingest. Keep both: fewer findings ever reach the layer your auditors watch.

Trivy Plugin install guide