Skip to content

Add Trivy installation and scanning targets to Makefile for vulnerability checks

Proposal:

This issue proposes adding two new targets in the project's Makefile to streamline vulnerability scanning using Trivy, a popular and lightweight security scanner.

These targets will help contributors and maintainers run dependency and file system scans consistently in their local development workflows.

Proposed Solution:

Add the following two targets to the root Makefile:

TRIVY_VERSION := v0.18.3
TRIVY_BIN := trivy

.PHONY: install-trivy scan

install-trivy:
	@echo "Installing Trivy $(TRIVY_VERSION)..."
	@curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b $(shell pwd)/bin $(TRIVY_VERSION)
	@echo "Trivy installed at ./bin/$(TRIVY_BIN)"

scan:
	@echo "Running Trivy scan on current directory..."
	@./bin/$(TRIVY_BIN) fs .

Impact:

Helps detect vulnerable packages early in the development cycle and encourages secure coding practices.

Edited by 🤖 GitLab Bot 🤖
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information