World C2: Container Pipelines

Stop the line on critical CVEs

You will learn: to scan every image and stop the line on a critical hole.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

The food inspector finds a recalled ingredient in tonight’s packs. What should the belt do?

Watch

A is a public ID for a known hole, like CVE-2099-0001. Scanners give each one a severity. Put them in order, mildest first.

Mildest at the top. Put these in order. Use the arrows, or drag.

MEDIUM
LOW
HIGH
CRITICAL

Predict

Trivy scans for CRITICAL holes, and the image has one. Tap the station that will stop the line. Or tap “Nothing stops it”.

Which station will stop the line? Tap it, then press Run.

What happened on GitHub

Push to main

Workflow file .github/workflows/scan.yml

1name: Scan
2on:
3  push:
4    branches: [main]
5permissions:
6  contents: read
7jobs:
8  scan:
9    runs-on: ubuntu-latest
10    steps:
11      - uses: docker/setup-buildx-action@v4
12      - uses: docker/build-push-action@v7
13        with:
14          load: true
15          tags: kedai-kancil:scan
16      - uses: aquasecurity/trivy-action@v0.36.0
17        with:
18          image-ref: kedai-kancil:scan
19          severity: CRITICAL

The line

Push to main · main

Watch

Tap the line that turns a finding into a red station.

0 of 1 found

Trivy ends with exit code 0 unless you ask. exit-code: '1' makes a finding fail the step. Red station, line stops.

Try it

Same image, now with exit-code: '1'. Press Run.

Pick an event. Press Run and watch the line.

What happened on GitHub

Push to main

Workflow file .github/workflows/scan.yml

1name: Scan
2on:
3  push:
4    branches: [main]
5permissions:
6  contents: read
7jobs:
8  scan:
9    runs-on: ubuntu-latest
10    steps:
11      - uses: docker/setup-buildx-action@v4
12      - uses: docker/build-push-action@v7
13        with:
14          load: true
15          tags: kedai-kancil:scan
16      - uses: aquasecurity/trivy-action@v0.36.0
17        with:
18          image-ref: kedai-kancil:scan
19          severity: CRITICAL
20          exit-code: '1'

The line

Push to main · main

Check

Good scan habit? Swipe right for yes, left for “needs work”.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Scan the exact image you are about to push

You did it!

You can now stop the line on a critical hole.

Go deeper (optional)

ignore-unfixed: true skips holes that have no fix yet. Docker Scout does the same job with docker/scout-action. Old images get new CVEs too. Scan them again on a schedule.

Real rep (optional), with Trivy installed from its official docs:

Real mission

Scan a small official image.
trivy image --severity CRITICAL --exit-code 1 alpine:3.22
Check the exit code: 0 means no critical holes.
echo $?
Add the Trivy step with exit-code: '1' to a practice repo.

0 of 3 steps done · Your ticks are saved.