Day 82: Shift-left: SCA & image scanning
Your dependencies are also your attack surface
Most of the code running in production isn't code you wrote — it's dependencies. SCA (Software Composition Analysis) scans your dependency tree against known-vulnerability databases (CVEs).
sca:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: aquasecurity/trivy-action@master
with:
scan-type: fs
severity: 'CRITICAL,HIGH'
exit-code: '1'Dependabot works differently: rather than blocking a build, it proactively opens PRs bumping vulnerable (or just outdated) dependencies to patched versions — shifting from "catch it" to "fix it automatically."
Image scanning
SCA checks your application's declared dependencies; image scanning checks the final built container image — including OS packages and anything baked in that your dependency manifest doesn't even know about (a vulnerable version of curl in the base image, for instance).
trivy image --severity CRITICAL,HIGH --exit-code 1 myregistry/api:${{ github.sha }}Key terms
- SCA
- Scanning a project's dependencies against known vulnerability databases.
- Image scanning
- Scanning a fully built container image (including OS packages) for known vulnerabilities.
Why do you need image scanning in addition to SCA scanning your application's package.json?
