Tooling

This page lists the build, lint, release, and codegen tools the project relies on, and where their configuration lives.

Build

• Go toolchain. Pinned in go.mod (go 1.25.8). The CI matrix (.github/workflows/test.yaml) installs the matching version with actions/setup-go.
• Mage. Task runner used as the project's "make". Tasks defined in magefiles/ (magefile.go, helm.go, vex.go, terraformplan.go, spdx.go, config_schema.go, docs.go, fixture.go, schema.go). Common targets:
  • mage build — build the trivy binary.
  • mage test:unit — run unit tests.
  • mage test:integration — run integration tests.
  • mage docs — regenerate the flag-table portion of the docs.
  • mage helm — package the Helm chart.
• goreleaser. Drives binary, archive, container image, and Homebrew tap publication. Config in goreleaser.yml. Canary builds use goreleaser-canary.yml. Releases are triggered by .github/workflows/release.yaml and the reusable workflow reusable-release.yaml.

Lint

• golangci-lint. Config in .golangci.yaml. Notable choices:
  • errcheck with check-type-assertions: true and check-blank: true.
  • depguard bans golang.org/x/exp/slices, golang.org/x/exp/maps, and io/ioutil.
  • dupl threshold 100, goconst min-len 3 / min-occurrences 3.
  • gocritic with the diagnostic tag enabled.
• zizmor. GitHub Actions security linter. Config in zizmor.yml; runs as part of supply-chain hygiene.

Code generation

• buf. Generates Twirp/protobuf stubs. Config in buf.gen.yaml and buf.yaml. The generated *.pb.go and *.twirp.go files are committed under rpc/.
• Rego embedding. The IaC engine pulls Rego policies from the trivy-checks repository and embeds them via pkg/iac/rego/embed.go.

Release

• release-please. Generates CHANGELOG.md and version bumps from Conventional Commit titles. Config in release-please-config.json and .release-please-manifest.json. Workflow: .github/workflows/release-please.yaml. The bot opens a release PR; merging it tags a release.
• release-pr-check. Validates the structure of release PRs. Workflow: .github/workflows/release-pr-check.yaml.
• Backports. .github/workflows/backport.yaml opens a backport PR when a merged PR is labeled backport-to-*.
• Container publication. goreleaser pushes images to Docker Hub (aquasec/trivy), GHCR (ghcr.io/aquasecurity/trivy), and ECR Public (gallery.ecr.aws/aquasecurity/trivy).
• Helm chart publication. .github/workflows/publish-chart.yaml packages and pushes the chart in helm/trivy/ to the Aqua Helm repo.

Docs

• MkDocs. Config in mkdocs.yml. Source in docs/. Two workflows publish the site:
  • .github/workflows/mkdocs-latest.yaml — on push to main.
  • .github/workflows/mkdocs-dev.yaml — for dev previews.
• test-docs.yaml validates docs build before merge.

Issue and PR automation

• .github/workflows/auto-close-issue.yaml — closes the linked issue when a PR is merged.
• .github/workflows/auto-ready-for-review.yaml — flips draft PRs to ready when checks pass.
• .github/workflows/auto-update-labels.yaml — applies labels based on title/body.
• .github/workflows/semantic-pr.yaml — enforces Conventional Commit titles.
• .github/workflows/stale-issues.yaml — closes inactive issues.
• .github/workflows/triage.yaml — runs triage automation.
• .github/workflows/auto-close-issue.yaml — closes auto-handled issues on merge.

Schema and SBOM helpers

• VEX schema. magefiles/vex.go and pkg/vex/ keep the VEX schemas in sync with upstream specs (CSAF, OpenVEX).
• CycloneDX/SPDX. magefiles/spdx.go regenerates SPDX license lists.
• Terraform plan schema. magefiles/terraformplan.go keeps the JSON schema synced with Terraform's CLI output.
• Config schema. magefiles/config_schema.go regenerates pkg/misconf/config_schema.go.

VEX policies for Trivy itself

The .vex/ directory contains VEX statements about vulnerabilities reported against Trivy itself (e.g., false positives in indirect dependencies). This is a small but useful example of dogfooding the VEX subsystem.