<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-dependency-vulnerability-scanning
description: >-
  Detect vulnerable dependencies in software projects using Trivy, Grype, and
  OSV-Scanner. Configure automated PR checks, SBOM generation, and license
  compliance to prevent supply chain attacks.
domain: cybersecurity
subdomain: devsecops
tags:
  - sca
  - dependency-scanning
  - trivy
  - grype
  - osv-scanner
  - sbom
  - supply-chain
  - license-compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Performing Dependency Vulnerability Scanning

## Overview

Software Composition Analysis (SCA) identifies known vulnerabilities in third-party
dependencies. This skill covers integrating Trivy, Grype, and OSV-Scanner into CI/CD
pipelines with SBOM generation, license compliance checks, and automated remediation
PRs. Addresses OWASP A06:2021 (Vulnerable and Outdated Components).

Mode: `[MODE: BLUE]` — Supply chain security through dependency analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| Trivy (`brew install trivy` / `apt install trivy`) or Grype CLI | Required |
| Package lockfiles | `package-lock.json`, `requirements.txt`, `go.sum`, `Cargo.lock` |
| GitHub Actions or GitLab CI for automation | Required |
| Python 3.10+ for agent script | Required |

## Key Concepts

### Trivy in GitHub Actions

```yaml
name: Dependency Scan
on:
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 8 * * 1'

jobs:
  trivy-sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy SCA
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: fs
          scan-ref: .
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif
```

### SBOM Generation with Syft

```yaml
name: Generate SBOM
on:
  push:
    tags: ['v*']

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          format: spdx-json
          output-file: sbom.spdx.json
      - name: Scan SBOM
        run: |
          grype sbom:sbom.spdx.json --output json > grype-results.json
      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.spdx.json
```

### OSV-Scanner for Multi-Ecosystem

```yaml
name: OSV Scan
on:
  pull_request:

jobs:
  osv:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: OSV-Scanner
        uses: google/osv-scanner-action/osv-scanner-action@v1
        with:
          scan-args: |-
            --recursive
            --format sarif
            --output osv-results.sarif
            .
```

### Renovate Auto-Remediation

```json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"],
    "assignees": ["security-team"]
  },
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "matchCurrentVersion": "!/^0/",
      "automerge": true,
      "automergeType": "pr"
    }
  ]
}
```

### License Compliance Check

```bash
# Check licenses with Trivy
trivy fs --scanners license --severity UNKNOWN,HIGH,CRITICAL .

# License allow-list
trivy fs --scanners license --license-full \
  --ignored-licenses "MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC" .
```

## Workflow

### Step 1: Scan Dependencies

```bash
node scripts/agent.js --action scan --source-dir . --output /tmp/dep-results.json
```

### Step 2: Generate SBOM

```bash
node scripts/agent.js --action sbom --source-dir . --output /tmp/sbom.json
```

### Step 3: Check License Compliance

```bash
node scripts/agent.js --action license --source-dir . --output /tmp/license-results.json
```

## Detection

```yaml
title: Dependency Vulnerability Scanning Detection
id: 4ce148e9-3b97-4768-bd16-8c9bd9788b1d
status: experimental
description: Detects suspicious activity related to performing dependency vulnerability scanning techniques in devsecops context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*performing*dependency*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.execution
falsepositives:
  - CI/CD pipeline executing authorized security scanning tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Dependency Vulnerability Scanning Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] Dependency scans run on every pull request
- [ ] Critical/high CVEs block merge
- [ ] SBOM generated for every release
- [ ] Automated remediation PRs created for fixable CVEs
- [ ] License compliance enforced against allow-list
- [ ] Weekly scheduled scans catch newly disclosed CVEs

## References

- [Trivy Documentation](https://aquasecurity.github.io/trivy/)
- [Grype Documentation](https://github.com/anchore/grype)
- [OSV-Scanner](https://google.github.io/osv-scanner/)
- [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/)
