Demo Create Shared Library for Trivy Scan

In this tutorial, you’ll build a reusable Jenkins Shared Library to run Trivy scans in your CI/CD pipelines. By isolating scanning logic in a library, you’ll eliminate duplication and enable versioned updates via Git feature branches.

Prerequisites

Requirement	Description
Jenkins Shared Library Repo	A Git repository to host your `vars/` functions
Trivy CLI	Installed on your Jenkins agents or build environment

1. Clone the Shared Library Repository

Start by cloning your existing shared-library project:

git clone http://64.227.187.25:5555/dasher-org/shared-libraries.git
cd shared-libraries
ls
# You should see:
# vars

2. Create a Feature Branch

Work on a dedicated branch to isolate your changes:

git checkout -b feature/trivy-scan

3. Review the Hardcoded Trivy Stage

In many pipelines, you’ll find a stage like this in the application’s Jenkinsfile:

stage('Trivy Vulnerability Scanner') {
  steps {
    sh '''
      trivy image my-org/app:$GIT_COMMIT \
        --severity LOW,MEDIUM,HIGH \
        --exit-code 0 \
        --quiet \
        --format json -o trivy-medium.json

      trivy image my-org/app:$GIT_COMMIT \
        --severity CRITICAL \
        --exit-code 1 \
        --quiet \
        --format json -o trivy-critical.json
    '''
  }
  post {
    always {
      // report conversion steps...
    }
  }
}

Hardcoding scanner commands in every Jenkinsfile is hard to maintain. Any change in flags or output formats would need updates in all pipelines.

4. Create the `TrivyScan.groovy` in `vars/`

Inside your shared-library’s vars/ folder, add a new file:

cd vars
touch TrivyScan.groovy

5. Define the `vulnerability` Function

Open vars/TrivyScan.groovy and add a method that accepts the Docker image name:

def vulnerability(String imageName) {
    sh """
      echo "🔒 Scanning image: ${imageName}"
      trivy image ${imageName} \
        --severity LOW,MEDIUM,HIGH \
        --exit-code 0 \
        --quiet \
        --format json -o trivy-medium.json

      trivy image ${imageName} \
        --severity CRITICAL \
        --exit-code 1 \
        --quiet \
        --format json -o trivy-critical.json
    """
}

We use triple-double-quotes ("""…""") in Groovy to allow ${imageName} interpolation inside the shell script block.

6. Add the `reportsConverter` Function

Extend the same file with report conversion logic:

def reportsConverter() {
    sh '''
      trivy convert \
        --format template --template "@usr/local/share/trivy/templates/html.tpl" \
        --output trivy-medium.html trivy-medium.json

      trivy convert \
        --format template --template "@usr/local/share/trivy/templates/html.tpl" \
        --output trivy-critical.html trivy-critical.json

      trivy convert \
        --format template --template "@usr/local/share/trivy/templates/junit.tpl" \
        --output trivy-medium.xml trivy-medium.json

      trivy convert \
        --format template --template "@usr/local/share/trivy/templates/junit.tpl" \
        --output trivy-critical.xml trivy-critical.json
    '''
}

7. Commit and Push Your Changes

Save, commit, and push the new shared-library logic:

git add vars/TrivyScan.groovy
git commit -m "feat: add TrivyScan shared library (vulnerability + reportsConverter)"
git push --set-upstream origin feature/trivy-scan

8. Consume the Shared Library in a Pipeline

In your application’s Jenkinsfile, load the library and call the functions:

@Library('shared-libraries@feature/trivy-scan') _

pipeline {
  agent any
  stages {
    stage('Security Checks') {
      steps {
        TrivyScan.vulnerability("my-org/app:${env.GIT_COMMIT}")
        TrivyScan.reportsConverter()
      }
    }
  }
}

Now your security scan is centralized, versioned, and easy to update!

Introduction and Basics

Jenkins Setup and Interface

Extending Jenkins and Administration

Jenkins Pipelines

Automation and Security

Setting up CI Pipeline

Code Quality and Testing

Containerization and Deployment

Kubernetes and GitOps

AWS Lambda and Advanced Deployment Techniques

Jenkins Administration and Monitoring - Part 1

Shared Libraries in Jenkins

Agents and Nodes in Jenkins

Pipeline Enhancement and Caching

Pipeline Structure and Scripted vs Declarative

Jenkins Administration and Monitoring - Part 2

Backup and Configuration Management

Demo Create Shared Library for Trivy Scan

Prerequisites

1. Clone the Shared Library Repository

2. Create a Feature Branch

3. Review the Hardcoded Trivy Stage

4. Create the `TrivyScan.groovy` in `vars/`

5. Define the `vulnerability` Function

6. Add the `reportsConverter` Function

7. Commit and Push Your Changes

8. Consume the Shared Library in a Pipeline

References

Watch Video

​Prerequisites

​1. Clone the Shared Library Repository

​2. Create a Feature Branch

​3. Review the Hardcoded Trivy Stage

​4. Create the TrivyScan.groovy in vars/

​5. Define the vulnerability Function

​6. Add the reportsConverter Function

​7. Commit and Push Your Changes

​8. Consume the Shared Library in a Pipeline

​References

Watch Video

Prerequisites

1. Clone the Shared Library Repository

2. Create a Feature Branch

3. Review the Hardcoded Trivy Stage

4. Create the `TrivyScan.groovy` in `vars/`

5. Define the `vulnerability` Function

6. Add the `reportsConverter` Function

7. Commit and Push Your Changes

8. Consume the Shared Library in a Pipeline

References