Trivy and DefectDojo in Woodpecker — A Security Inbox for Every Build
Gitleaks catches secrets in git history. It does not catch outdated dependencies, misconfigured Dockerfiles, or a vulnerable base image referenced in documentation. Trivy fills that gap with a filesystem scan on every push and pull request. DefectDojo stores the JSON reports so findings accumulate instead of disappearing into CI logs.
The trivy-fs step runs after Gitleaks and before build. It scans the repo with --severity HIGH,CRITICAL and --scanners vuln,misconfig, skipping node_modules, vendor, dist, .git, and site. Output lands in trivy-report.json; ok or fail flags are written to dotfiles the gate step reads later.
Scanning the filesystem — not just package-lock.json in isolation — catches Docker compose issues, exposed configs, and dependency trees the app build never touches. On a small VPS, the step runs serially after Gitleaks to keep RAM predictable.