Run Vulnlog in CI pipelines

The Vulnlog CLI runs on developer machines and in CI pipelines.

A common pattern is dynamic suppression: generate suppression files in the CI pipeline just before the scanner runs, so they are always in sync with the Vulnlog file and never need to be committed. See Generate suppression files for your scanner for both approaches.

Gradle

For Gradle-based builds, the Vulnlog Gradle plugin wires validate, suppress, and init into your build. See Gradle Plugin for details.

GitHub Actions

The Setup Vulnlog CLI action installs the CLI on the runner and puts it on PATH. Install it once per job, every later step calls vulnlog directly.

Example workflow using dynamic suppression. The suppression file is generated, used by the scanner, and discarded after the pipeline completes:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Vulnlog CLI
        uses: vulnlog/setup-vulnlog@v1
        with:
          version: 0.18.0

      - name: Generate suppression files
        continue-on-error: true
        run: vulnlog suppress --reporter trivy vulnlog.yaml

      - name: Ensure suppression file exists
        run: |
          [ -f .trivyignore.yaml ] || touch .trivyignore.yaml

      - name: Run Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          scan-ref: .
          format: sarif
          output: trivy-results.sarif
          trivyignores: .trivyignore.yaml

      - name: Upload Trivy SARIF to GitHub
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: trivy-results.sarif
          category: trivy

      - name: Generate Vulnlog HTML report
        if: always()
        run: vulnlog report impact vulnlog.yaml

      - name: Upload Vulnlog HTML report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: vulnerability-report
          path: vulnlog-impact-report.html

Pin the version input so the pipeline does not change when a new Vulnlog release ships. See GitHub Action for the inputs, outputs, and supported runners.

Using the Docker image

On CI systems without a Vulnlog integration, run the container image. In most CI environments (Jenkins, GitLab CI, GitHub Actions) the runner’s workspace is owned by UID 1000, so the container works without extra flags:

docker run --rm -v "$PWD:/work" ghcr.io/vulnlog/vulnlog:0.18.0 suppress vulnlog.yaml --reporter trivy

When the CI runner requires root access, override the user at runtime:

docker run --rm --user root -v "$PWD:/work" ghcr.io/vulnlog/vulnlog:0.18.0 suppress vulnlog.yaml

Validating in CI

Running validation as part of the CI pipeline catches Vulnlog file errors early:

vulnlog validate my-app.vl.yaml --strict

--strict treats warnings as errors.