Shifting Left: Integrating Security Scanners (Trivy, Checkov) into CI/CD

Introduction

Fixing a security vulnerability after a system is deployed to production is expensive and complex. The “Shift Left” philosophy addresses this issue by integrating automated security scanners directly into the early stages of the continuous integration (CI) pipeline, blocking insecure deployments before they occur.

Scanning Infrastructure as Code with Checkov

Checkov is a static analysis tool that scans IaC configurations to catch security misconfigurations before resources are provisioned. Integrating Checkov into GitHub Actions is straightforward:

job-scan-iac:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - name: Run Checkov Static Analysis
      uses: bridgecrewio/checkov-action@master
      with:
        directory: terraform/
        framework: terraform

Scanning Images with Trivy

While Checkov scans your infrastructure code, Trivy checks your container images for known vulnerabilities and CVEs before they go live.