The layers that matter
Pick one tool per layer and wire it into CI. Adding a second tool in the same layer usually doubles the noise without doubling the coverage.
| Layer | Tools | Why it earns its slot |
|---|---|---|
| Secrets detection | gitleaks, trufflehog | Catches credentials before they reach the remote. Cheapest possible failure — runs in seconds on every commit. |
| SAST (static analysis) | CodeQL, Semgrep | Finds injection, unsafe deserialization, and auth mistakes in your own code. CodeQL is free for public repos on GitHub. |
| SCA (dependencies) | Trivy, Dependabot, osv-scanner | Most real risk lives in transitive dependencies. Trivy reads lockfiles directly and reports fixed-in versions. |
| Container scanning | Trivy, Grype | Scans the built image, not just the source — catches OS packages baked into the base layer. |
| IaC scanning | Trivy config, Checkov, tfsec | Public S3 buckets and open security groups are configuration bugs, not code bugs. |
| Supply chain | syft (SBOM), cosign (signing) | An SBOM turns 'are we affected?' into a query instead of an all-night grep. |
| Runtime monitoring | Prometheus, Grafana, Falco | CVEs are published after you deploy. Re-scan on a schedule and alert on anomalous behaviour. |
Why Trivy covers three layers
Trivy is the highest-leverage single tool here: one binary does dependency scanning, container image scanning, IaC misconfiguration checks, and SBOM generation. On my own projects it replaced three separate scanners.
# dependencies + secrets in the repo trivy fs --scanners vuln,secret --severity HIGH,CRITICAL . # the built image, OS packages included trivy image --ignore-unfixed --exit-code 1 app:latest # terraform / kubernetes manifests trivy config ./infra # SBOM for the release trivy sbom --format cyclonedx --output sbom.json app:latest
Wiring it into GitHub Actions
GitHub Actions is the cheapest place to enforce all of this: SARIF uploads surface findings in the Security tab, and OIDC removes the need for long-lived cloud keys.
permissions:
contents: read
security-events: write
id-token: write
steps:
- uses: actions/checkout@v4
- uses: gitleaks/gitleaks-action@v2
- uses: github/codeql-action/init@v3
with: { languages: javascript }
- uses: aquasecurity/trivy-action@0.24.0
with:
scan-type: fs
severity: HIGH,CRITICAL
exit-code: '1'
ignore-unfixed: true
format: sarif
output: trivy.sarif
- uses: github/codeql-action/upload-sarif@v3
with: { sarif_file: trivy.sarif }For the full pipeline — build, image scan, SBOM, and deploy — see the secure CI/CD pipeline guide.
Choosing between overlapping tools
- Trivy vs Grype — both scan images well. Trivy wins if you also want IaC and secrets in the same binary.
- CodeQL vs Semgrep — CodeQL is deeper and free on public repos; Semgrep is faster and easier to write custom rules for.
- Dependabot vs Trivy — Dependabot opens the upgrade PRs, Trivy blocks the merge. They complement rather than compete.
- Falco vs plain metrics — skip Falco until you have Prometheus and alerting working; runtime detection without on-call is decoration.
A sane rollout order
- Branch protection + secret scanning — one afternoon, immediate payoff.
- Trivy filesystem scan on pull requests, warning only.
- Flip it to
exit-code: 1on HIGH/CRITICAL once the backlog is clear. - Add image scanning at build time and OIDC for deploys.
- Generate SBOMs and sign artifacts.
- Add scheduled re-scans and runtime monitoring.
Wrap-up
A DevSecOps toolchain is not a shopping list — it is one enforced default per layer, each failing loudly in CI. Start with secrets and dependencies, and only add tools when a real incident shows you the gap.
Written by Piyush Prasad — Cloud & DevOps Engineer. Back to portfolio.