The Trivy scan fails if any critical vulnerabilities are found. The problem is what failed the build isn't immediately visible; it's buried in the logs and stored artifact.
Feature
Create a PR comment of the critical vulnerability that is found for a failed build.
Security Gate Configurations
- Provide a configurable security gate (ex: fail the build if >1 critical vuln is found)
- Always provide a report, even if the security gate fails. Users need to know why the security gate failed.
- Vuln findings should have CVEs, and CVEs should be linked to CVE vuln page
- Security gate option: vulns without fixes don't fail the CI/build
- Security gate option: allow configurable summary report columns (ex: User can change which columns show up on the report)
The Trivy scan fails if any critical vulnerabilities are found. The problem is what failed the build isn't immediately visible; it's buried in the logs and stored artifact.
Feature
Create a PR comment of the critical vulnerability that is found for a failed build.
Security Gate Configurations