How to contribute

Trivy is an open-source project and accepts pull requests. This section tells you how the project is laid out for contributors, where to file issues, and what to expect during review.

The canonical contribution guide is the upstream documentation at trivy.dev/docs/community/contribute. The repo's own CONTRIBUTING.md file is a one-line pointer there. This wiki section augments that guide with an in-tree map of the conventions you will encounter when reading the code.

Pages

• Development workflow — branching, commits, and PR mechanics.
• Testing — unit, integration, and module tests.
• Debugging — logging, tracing, and reproducing scan issues.
• Patterns and conventions — coding style, error handling, registration patterns.
• Tooling — Mage, golangci-lint, goreleaser, release-please, and the doc site.

Where to file issues and PRs

• Bugs and feature requests — github.com/aquasecurity/trivy/issues. The labels kind/bug, kind/feature, and discuss are auto-applied by .github/workflows/auto-update-labels.yaml.
• Discussions — github.com/aquasecurity/trivy/discussions.
• Security reports — see SECURITY.md. Do not file public issues for security bugs.
• Pull requests — fork-and-PR against main. The .github/workflows/auto-ready-for-review.yaml workflow flips draft PRs to ready when all checks pass.

Definition of done

A PR is ready to merge when:

1. Tests are added or updated and go test ./... passes.
2. golangci-lint run is clean (config in .golangci.yaml).
3. Integration tests (when relevant) pass in CI (.github/workflows/test.yaml).
4. The PR title follows Conventional Commits — release-please relies on it (feat:, fix:, refactor:, chore:, docs:, etc.). The semantic-pr workflow (.github/workflows/semantic-pr.yaml) enforces this.
5. The CLA bot is green; bypass-cla.yaml is reserved for maintainer use.
6. Docs are updated when adding or renaming user-visible flags or commands. User-facing docs live in docs/.

Reviews

Reviews are typically led by:

• The original author (Teppei Fukuda / knqyf263) for cross-cutting concerns and CLI-shaped changes.
• Subsystem owners (see maintainers) for area-specific changes.
• The IaC team (Owen Rumney, Nikita Pivkin, etc.) for pkg/iac/.

Expect first-pass review within a few business days for non-trivial changes.

Backports

Backports to release branches are handled by the .github/workflows/backport.yaml workflow. Apply the backport-to-<branch> label to a merged PR and the bot opens a backport PR.