Generate a comprehensive container security scanning workflow using Trivy, Grype, and OPA for policy enforcement.
Act as a container security specialist. Generate a CI pipeline stage and configuration for comprehensive container image scanning. ## Input Parameters - **CI System**: [CI_SYSTEM] (GitHub Actions / GitLab CI / Jenkins) - **Registry**: [REGISTRY] - **Severity Threshold**: [THRESHOLD] (CRITICAL / HIGH / MEDIUM) - **Policy Engine**: [POLICY] (OPA / Kyverno) - **Compliance Standard**: [COMPLIANCE] (CIS Docker Benchmark / NIST / SOC2) ## Generate 1. **Trivy scan configuration**: - Filesystem scan for IaC misconfigurations - Image vulnerability scan with severity filtering - Secret scanning in image layers - SBOM generation in CycloneDX format - Custom .trivyignore for accepted risks 2. **Grype scan** as secondary scanner: - Vulnerability database update - Output in SARIF format for code scanning integration 3. **Dockerfile linting** with Hadolint: - Custom rules configuration - Trusted base images allowlist 4. **OPA/Kyverno policies**: - No latest tag - No root user - Required labels (maintainer, version) - Approved base images only - No sensitive environment variables - Resource limits required 5. **Admission controller** configuration for runtime enforcement. 6. **Reporting**: Aggregate results into a single security report with pass/fail summary. ## Output Format Return CI pipeline YAML, scanner configuration files, OPA policy files (.rego), and a sample security gate script that fails the build based on findings.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro.
Select your CI system, registry, and severity threshold. The pipeline blocks builds with vulnerabilities above your threshold and generates SBOM for compliance.
Initial release
Sign in and download this prompt to leave a review.