---
title: "Use Trivy to scan images and dependencies · Agent Wranglers"
url: https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/trivy
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Use Trivy to scan images and dependencies

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/stack/rules.json) holds every rule of this playbook as JSON.

- Level: Recommended
- Chapter: [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure)
- Rule: Scan every container image, lock file and infrastructure file with Trivy in CI, and pin Trivy itself by image digest or full commit hash.
- Cost: Open source. Apache-2.0 licence, free to run in any build.
- How: Trivy's repository opened in April 2019, and 0.76.0 shipped on 14 October 2026. It has never reached 1.0, so record it as an exception. Its GitHub repository had about 38,600 stars in October 2026. One binary scans images, file systems, lock files and Terraform or Kubernetes files. On 19 March 2026, attackers used stolen credentials to publish a malicious Trivy 0.69.4. They also moved 76 of 77 version tags of its GitHub Action to code that stole credentials. The advisory tells users to pin actions to full commit hashes, never version tags. Gate each image as [Scan every image before it ships](https://agentwranglers.se/playbook/operations/containers/image-scanning) says. Choose something else when a policy bars a tool with a recent supply chain breach. Grype is Apache-2.0, first published in May 2020, and 0.121.0 shipped on 19 October 2026.
- Check: Every CI step that runs Trivy names it by image digest or full commit hash, never by tag. The image scan exits non-zero on a critical finding that has a fix.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
TRIVY=aquasec/trivy@sha256:0000000000000000000000000000000000000000000000000000000000000000
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock "$TRIVY" image --exit-code 1 --severity CRITICAL --ignore-unfixed shop:latest
docker run --rm -v "$PWD:/src" "$TRIVY" fs --exit-code 1 --severity CRITICAL /src
```

### YAML example

```yaml
# The full commit hash of a release you checked, never a tag such as @0.35.0
- uses: aquasecurity/trivy-action@0000000000000000000000000000000000000000
  with:
    image-ref: shop:latest
    exit-code: '1'
    severity: CRITICAL
    ignore-unfixed: true
```

## Sources

- [CVE-2026-33634 Trivy supply chain compromise](https://nvd.nist.gov/vuln/detail/CVE-2026-33634)
- [Trivy](https://trivy.dev/docs/latest/)

## Related rules

- [Scan every image before it ships](https://agentwranglers.se/playbook/operations/containers/image-scanning) in Operations

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/trivy">Agent Wranglers software choices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Use SOPS for secrets](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/secrets-manager-or-sops)
- [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure)