Integrate Trivy and Snyk into your CI/CD pipeline by scanning container images and source code at build time, then fail the job if findings exceed defined severity thresholds.
Steps
1. Add Trivy to the build image
```dockerfile
FROM aquasec/trivy:latest AS scanner
```
2. Cache Trivy DB in the CI workspace to avoid full download each run.
```bash
trivy image --download-db-only
```
3. Scan the built image and output JSON for downstream parsing.
```bash
trivy image --severity HIGH,CRITICAL --format json -o trivy-report.json $IMAGE_TAG
```
4. Run Snyk on source (Node, Python, etc.) with a fail‑on‑threshold flag.
```bash
snyk test --severity-threshold=high --json > snyk-report.json
```
5. Fail the pipeline if either report contains findings above the threshold. Example for GitHub Actions:
```yaml
- name: Evaluate reports
run: |
jq 'select(.Severity=="HIGH" or .Severity=="CRITICAL")' trivy-report.json && exit 1
jq '.vulnerabilities[] | select(.severity=="high" or .severity=="critical")' snyk-report.json && exit 1
```
6. Publish results as artifacts for audit.
Tool comparison
| Feature | Trivy | Snyk |
|------------------|------------------------------------|------------------------------------|
| Scans | Container images, filesystem | Source code, dependencies |
| DB update | trivy db update (cached) | Cloud‑managed, no local DB |
| CI integration | CLI, Docker, GitHub Action | CLI, GitHub Action, Bitbucket Pipelines |
| Free tier limits | Unlimited scans, rate‑limited API | 100 tests/month for free tier |
Gotcha: If the CI runner does not preserve the ~/.cache/trivy directory between jobs, Trivy will re‑download its vulnerability database each run, adding 2‑5 minutes to the pipeline. Ensure the cache is defined as a persistent volume or CI cache key.