Trivy and DefectDojo in a Static-Site Pipeline
A common assumption in web development is that static single-page websites do not require serious security scanning. After all, a pre-rendered portfolio possesses no backend database to inject, no server-side sessions to hijack, and no user authentication cookies to steal. Why bother running enterprise-grade vulnerability scanners on static HTML and CSS?
This perspective overlooks the software supply chain. While the runtime output is static, the build pipeline pulls hundreds of third-party npm packages, executes automated build scripts, and builds container images. Running Aqua Security Trivy and OWASP DefectDojo in our Woodpecker pipeline allows us to enforce enterprise DevSecOps hygiene on a site we control end to end.
Trivy is an industry-leading open-source vulnerability and misconfiguration scanner. In our Woodpecker CI pipeline, Trivy runs in filesystem (`fs`) mode against the repository root prior to compiling frontend bundles.