Scanners¶
The pipeline runs open source tools against every built image and, where configured, the source and the running application. Attest reads their output; it does not run them. As tools change, the gates and the record change with them.
| Console label | Tool | What it does | Feeds |
|---|---|---|---|
| Vulnerabilities | Syft + Grype | Inventories every package in the image (SBOM) and matches it against known CVEs. | G2, S1, S2 |
| Secrets | TruffleHog | Searches the image and source for credentials. A verified match was checked live against the provider; an unverified match is a pattern. | G4 |
| Malware | ClamAV | Signature scan of every file in the image. | G3 |
| Build file lint | Hadolint | Checks the Dockerfile against build hygiene rules. Errors block; warnings are triaged. | G7, S3 |
| Static analysis | Semgrep | Pattern based static analysis of the source. Findings are keyed by rule id. | G6 |
| Container spec | cDSO container spec | Base image, running user, and the other properties the pipeline reads from the built image. | G5 |
| Dynamic scan | OWASP ZAP | Runtime scan of the served application for the OWASP alert classes. | S4 |
| Test coverage | coverage | Line coverage reported by the application test job. | S5 |
G1 (all scan stages pass) and S6 (no failed CI jobs) are evaluated from the pipeline run itself.
What each result carries¶
Vulnerabilities. Per CVE: id, severity, the artifacts it was found in, the fixed version where one exists, and its pool: unmitigated, mitigated, or pending. Counts by severity. The vulnerability database build date, compared to the scan date for S2.
Secrets. Live (verified) matches and documented false positives suppressed by trufflehog.excluded_files. Per match: file, line, detector, and whether it verified.
Malware. Infected files and files scanned. The scan end time.
Build file lint. Findings by level: error, warning, info. Per finding: rule code, line, and message.
Static analysis. Open findings and rules excluded by policy. Per finding: rule id and file.
Container spec. The FROM lines, valid and invalid, and the running user.
Dynamic scan. Alerts, with mitigation count and unmitigated warnings.
Where the raw output is¶
Every scanner's full output is in the scan directory in the security repository, one file per scanner, and opens in a viewer from the evidence panel on any container page. Attest presents the human centric view first and keeps the raw file one click away.