Create Shared Library for Trivy Scan

In this guide, you’ll learn how to extract Trivy vulnerability scanning logic into a reusable Jenkins Shared Library. By the end, you will be able to:

• Version and maintain your scanning scripts centrally
• Simplify your Jenkinsfiles across multiple repositories
• Generate HTML and JUnit XML reports for scan results

Objectives

1. Clone the shared-libraries repository
2. Create a new feature branch
3. Review the existing Trivy stage in your Jenkinsfile
4. Implement vars/TrivyScan.groovy with two methods
5. Commit and push your changes

1. Clone the Shared Libraries Repository

First, clone the central library repository where your custom steps live.

git clone http://64.227.187.25:5555/dasher-org/shared-libraries.git
cd shared-libraries
ls
# → vars

2. Create a Feature Branch

Branch off main (or your default branch) to implement the Trivy scan logic.

git checkout -b feature/TrivyScan

3. Review the Existing Jenkinsfile Stage

Here’s the current Trivy Vulnerability Scanner stage in the Solar System project’s Jenkinsfile:

stage('Trivy Vulnerability Scanner') {
    steps {
        sh '''
            trivy image siddharth67/solar-system:$GIT_COMMIT \
                --severity LOW,MEDIUM,HIGH \
                --exit-code 0 \
                --quiet \
                --format json -o trivy-image-MEDIUM-results.json

            trivy image siddharth67/solar-system:$GIT_COMMIT \
                --severity CRITICAL \
                --exit-code 1 \
                --quiet \
                --format json -o trivy-image-CRITICAL-results.json
        '''
    }
    post {
        // conversions and reports go here
    }
}

We want to remove this inlined logic and replace it with calls to our Shared Library.

4. Create vars/TrivyScan.groovy

Under shared-libraries/vars, add a new file named TrivyScan.groovy with two methods: one for scanning vulnerabilities, and one for converting the JSON output into HTML and JUnit XML.

// vars/TrivyScan.groovy

def vulnerability(String imageName) {
    sh """
        echo "🔍 Scanning image: ${imageName}"

        trivy image ${imageName} \
            --severity LOW,MEDIUM,HIGH \
            --exit-code 0 \
            --quiet \
            --format json -o trivy-image-MEDIUM-results.json

        trivy image ${imageName} \
            --severity CRITICAL \
            --exit-code 1 \
            --quiet \
            --format json -o trivy-image-CRITICAL-results.json
    """
}

def reportsConverter() {
    sh """
        # Generate HTML reports
        trivy convert \
            --format template \
            --template "/usr/local/share/trivy/templates/html.tpl" \
            --output trivy-image-MEDIUM-results.html \
            trivy-image-MEDIUM-results.json

        trivy convert \
            --format template \
            --template "/usr/local/share/trivy/templates/html.tpl" \
            --output trivy-image-CRITICAL-results.html \
            trivy-image-CRITICAL-results.json

        # Generate JUnit XML reports
        trivy convert \
            --format template \
            --template "/usr/local/share/trivy/templates/junit.tpl" \
            --output trivy-image-MEDIUM-results.xml \
            trivy-image-MEDIUM-results.json

        trivy convert \
            --format template \
            --template "/usr/local/share/trivy/templates/junit.tpl" \
            --output trivy-image-CRITICAL-results.xml \
            trivy-image-CRITICAL-results.json
    """
}

Shared Library Methods at a Glance

5. Commit and Push Your Changes

Once your library file is in place:

git add vars/TrivyScan.groovy
git commit -m "feat(shared-library): add TrivyScan with vulnerability and reportsConverter methods"
git push -u origin feature/TrivyScan

Next Steps

1. Integrate TrivyScan.vulnerability(imageName) and TrivyScan.reportsConverter() into your project’s Jenkinsfile.
2. Tag or merge your branch when you’re ready to release the Shared Library.
3. Monitor the generated reports in your CI/CD pipeline and enforce policies based on exit codes.

Links and References

• Jenkins Shared Library Documentation
• Trivy: A Simple and Comprehensive Vulnerability Scanner
• Git Basics