@codacy/tools-trivy-0

Table of Contents

• Overview
• Umbrella patterns
• Updating patterns
• Updating the Trivy version
• Development
• Notes for maintainers

Overview

Security scanner using the Trivy binary. Scans for vulnerabilities in dependencies and hardcoded secrets. Uses the CLI execution strategy with two separate scan modes (vulnerability + secret).

| Property | Value | |----------|-------| | Tool ID | Trivy | | Codacy UUID | 2fd7fbe0-33f9-4ab3-ab73-e9b62404e2cb | | Strategy | CLI | | Languages | Multi-language (scans dependency manifests) | | Binary | trivy | | File patterns | * (auto-detects dependency manifests) | | Pattern count | 6 (umbrella patterns) |

Umbrella patterns

Trivy uses umbrella patterns rather than individual CVE patterns:

| Pattern ID | Severity | Description | |------------|----------|-------------| | Trivy_vulnerability_critical | Error | Critical vulnerabilities | | Trivy_vulnerability_high | High | High-severity vulnerabilities | | Trivy_vulnerability_medium | Warning | Medium-severity vulnerabilities | | Trivy_vulnerability_minor | Info | Low-severity vulnerabilities | | Trivy_secret | Error | Hardcoded secrets | | Trivy_malicious_packages | Error | Malicious packages (reserved) |

Updating patterns

# Re-fetch pattern metadata from the Codacy API
pnpm prefetch

# Commit the result
git add src/patterns.json

Updating the Trivy version

1. Update preferredVersion in src/adapter.ts
2. Update the download URL template if the release format changed
3. Run pnpm test to verify compatibility

Development

pnpm build    # Build with tsup
pnpm test     # Run tests (requires trivy in PATH or auto-install)

Notes for maintainers

• Trivy runs two separate scan invocations: one for vulnerabilities (--scanners vuln) and one for secrets (--scanners secret). Which scans run depends on which umbrella patterns are enabled.
• The vulnerability database is downloaded lazily on first run to --cache-dir ~/.codacy/cache/trivy/. Internet access is required on first use.
• Trivy scans whole directories, not individual files. Results are filtered to ctx.targetFiles after scanning.
• The binary is downloaded from GitHub releases as a .tar.gz archive.
• Vulnerability severity (CRITICAL/HIGH/MEDIUM/LOW) maps to the corresponding umbrella pattern.
• Message format: Insecure dependency {pkg}@{version} ({CVE}: {title}). Update to {fixedVersion}.
• Config file: checks for trivy.yaml in the repo root.