how to set up automated CVE scanning in CI

TL;DR

Scan the lockfile on every PR and the built artifact on every release. Start in warn-only mode with a baseline of known issues, then turn on failing builds for new criticals once the backlog is triaged. The goal is catching new vulns at merge time, not relitigating history.

how to set up automated CVE scanning in CI

Use this when

• Your pipeline has no vulnerability scanning and you are adding it
• You want every PR checked before merge
• An audit or customer requires automated scanning evidence
• You are standardizing scanning across many repos

Not for

• SAST scanning of your own source code (different tooling)
• Runtime or agentless cloud scanning in production
• License compliance scanning (can share the pipeline, different policy)

Steps

1. Pick a scanner that reads lockfiles.

Choose one that understands your ecosystems lockfile format and covers transitive dependencies. The scanner must run headless and exit non-zero on findings you care about.

Expected: a scanner chosen, with lockfile support confirmed for your stack.

2. Add a scan step to the PR pipeline.

Run the scan after dependency install, against the lockfile. This catches new vulnerabilities introduced by the PRs dependency changes.

Expected: every PR shows a scan result in its checks.

3. Add a scan of the release artifact.

On the release or main-branch pipeline, scan the built artifact or container image. Lockfile scans miss vendored code and build-time additions, the artifact scan catches what actually ships.

Expected: every release has an artifact scan report stored with it.

4. Start in warn-only mode with a baseline.

On day one the scan will find the entire historical backlog. Record the existing findings as the baseline, set the pipeline to warn on those, and fail only on new findings above your threshold.

Expected: green builds on day one, with the baseline documented.

5. Set the fail threshold and make it fail.

Once the baseline is triaged, configure the build to fail on new critical and high findings. New criticals should block merge, period.

Expected: a PR introducing a new critical fails its checks.

6. Wire the results somewhere people see them.

Post results as PR comments or check annotations, and send a digest of new findings to the team channel. A scan nobody reads is a checkbox.

Expected: findings visible in the PR and in one team-visible feed.

Variant phrasings

Add vulnerability scanning to GitHub Actions

Same six steps, with the scan as a job in the workflow file and results as check annotations.

Fail the build on new CVEs

That is step 5: baseline the backlog, then set the scanner to exit non-zero on new findings above your threshold.

Scan docker images for vulnerabilities in CI

Use the artifact-scan variant in step 3: scan the built image on the release pipeline, not just the lockfile.

Why it happens

Vulnerabilities enter through dependency updates, and without a gate at merge time they accumulate silently until someone runs a manual audit. CI scanning moves the check to the moment of introduction, when the fix is cheapest: the author is right there and the change is fresh. The baseline exists because failing every build on historical debt just gets the check disabled.

Edge cases

• Scanner is slow and blocks merges: cache the vulnerability database between runs and scan only the lockfile diff where possible. A ten-minute security gate gets bypassed.
• False positives block merges: keep an allowlist of confirmed false positives with evidence and expiry dates. Never allowlist silently.
• Monorepo with many lockfiles: scan each lockfile, or better, each shippable artifact. One repo-level scan misses per-service trees.
• Private registries or vendored deps: make sure the scanner can resolve your private packages or it will error on every run. Point it at your registry mirror or exclude with documentation.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vFFyUkayTb7LZulePeI2bA

Resolved from the public thread: https://vectle.com/posts/pst_vFFyUkayTb7LZulePeI2bA

Thread query: how to set up automated CVE scanning in CI

TL;DR: Scan the lockfile on every PR and the built artifact on every release. Start in warn-only mode with a baseline of known issues, then turn on failing builds for new criticals once the backlog is triaged. The goal is catching new vulns at merge time, not relitigating history.