# aquasecurity/trivy-action in GitHub Actions

> The aquasecurity/trivy-action wraps Trivy for GitHub Actions. Reference for inputs like scan-type, severity, exit-code, and the SARIF upload errors.

Source: https://latchkey.dev/learn/command-reference/trivy-github-action  
Updated: 2026-06-30

The aquasecurity/trivy-action runs Trivy as a GitHub Actions step with inputs that map to the CLI flags.

Rather than installing Trivy by hand, most GitHub workflows use the official action. Its inputs mirror the CLI, and its SARIF output integrates with code scanning.

## What it does

aquasecurity/trivy-action installs Trivy and runs a scan based on its inputs. scan-type selects image, fs, or config; image-ref or scan-ref names the target; severity, exit-code, and format map to the matching CLI flags. With format: sarif it produces a file you upload via github/codeql-action/upload-sarif.

## Common usage

```YAML
- uses: aquasecurity/trivy-action@master
  with:
    scan-type: image
    image-ref: myorg/app:${{ github.sha }}
    severity: HIGH,CRITICAL
    exit-code: '1'
    ignore-unfixed: true
- uses: aquasecurity/trivy-action@master
  with:
    scan-type: fs
    format: sarif
    output: trivy.sarif
```

## Options

| Input | What it does |
| --- | --- |
| scan-type | image, fs, config, repo, or sbom |
| image-ref / scan-ref | Target image or path to scan |
| severity | Comma list of severities to report |
| exit-code | Exit code on findings (string, e.g. '1') |
| format | table, json, sarif, cyclonedx |
| ignore-unfixed | Skip vulnerabilities with no fix |

## In CI

Set exit-code: 1 with severity: HIGH,CRITICAL to gate, and pass ignore-unfixed: true to avoid blocking on unfixable CVEs. To use code scanning, set format: sarif and a fixed output: path, then run github/codeql-action/upload-sarif with that file and if: always() so it uploads even when the gate fails.

## Common errors in CI

"Resource not accessible by integration" on the SARIF upload means the job lacks security-events: write permission; add it to the workflow or job. A gate that does not fail often passes exit-code as a number where the action expects a string. The SARIF upload step is skipped when the scan step fails unless you add if: always().

## FAQ

### aquasecurity/trivy-action in GitHub Actions?

Rather than installing Trivy by hand, most GitHub workflows use the official action. Its inputs mirror the CLI, and its SARIF output integrates with code scanning.

### What it does?

aquasecurity/trivy-action installs Trivy and runs a scan based on its inputs. scan-type selects image, fs, or config; image-ref or scan-ref names the target; severity, exit-code, and format map to the matching CLI flags. With format: sarif it produces a file you upload via github/codeql-action/upload-sarif.

### In CI?

Set exit-code: 1 with severity: HIGH,CRITICAL to gate, and pass ignore-unfixed: true to avoid blocking on unfixable CVEs. To use code scanning, set format: sarif and a fixed output: path, then run github/codeql-action/upload-sarif with that file and if: always() so it uploads even when the gate fails.

### Common errors in CI?

"Resource not accessible by integration" on the SARIF upload means the job lacks security-events: write permission; add it to the workflow or job. A gate that does not fail often passes exit-code as a number where the action expects a string. The SARIF upload step is skipped when the scan step fails unless you add if: always().

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt