Max Total + Trivy Vulnerability Scanner Collector

✓ Guardrail ↓ Collector Stable Security And Compliance

Enforce Max Total using data collected by Trivy Vulnerability Scanner Collector. Automatically check security and compliance standards on every PR.

Guardrail: Ensures total vulnerabilities are under a configurable threshold.

Data Source: Automatically scans repository dependencies for known CVEs using Trivy. Supports Go, Node.js, Python, Java, Rust, and many other ecosystems. Writes normalized vulnerability data to .sca for use with the SCA policy. No secrets or vendor accounts required.

Get Started View on GitHub

How Trivy Vulnerability Scanner Collector Powers This Guardrail

The Trivy Vulnerability Scanner Collector gathers metadata from your security systems. This data flows into Lunar's Component JSON, where the Max Total guardrail evaluates it against your standards.

When enabled, this check runs automatically on every PR and in AI coding workflows, providing real-time enforcement with actionable feedback.

↓ Trivy Vulnerability Scanner Collector Gathers Data Collector

Extracts metadata from code, configs, and tool outputs

{ } Component JSON

Data centralized in structured format for evaluation

✓ Max Total Checks Guardrail

Pass/fail result with actionable feedback in PRs

Quick Start Configuration

Add both the collector and policy to your lunar-config.yml to enable this guardrail.

📄 lunar-config.yml

# Step 1: Enable the Trivy Vulnerability Scanner Collector
collectors:
  - uses: github://earthly/lunar-lib/collectors/trivy@v1.0.5
    # with: ...

# Step 2: Enable the SCA Guardrails
policies:
  - uses: github://earthly/lunar-lib/policies/sca@v1.0.5
    include: [max-total]
    # with: ...

What Trivy Vulnerability Scanner Collector Collects

This collector gathers the following data that the Max Total guardrail evaluates.

Collector code

`auto`

Auto-scans the repository filesystem for dependency vulnerabilities using Trivy. Writes normalized findings to .sca with severity counts, CVE IDs, affected packages, and fix versions.

Collector ci-after-command

`cicd`

Detects Trivy executions in CI pipelines. Captures the command, version, and input arguments for audit and compliance tracking.

Collector cron

`rescan`

Re-runs the dependency (SCA) scan on a schedule and overwrites .sca so the SCA policy re-evaluates against CVEs published since the commit was first scanned — closing the gap where a branch passes at scan time but a dependency picks up a new CVE later. Runs the same scan as the auto collector (the sibling auto.sh) in the Trivy collector image.

Example Data Flow

Here's an example of the data that Trivy Vulnerability Scanner Collector writes to the Component JSON, which Max Total then evaluates.

{ } component.json From Trivy Vulnerability Scanner Collector

{
  "sca": {
    "source": {
      "tool": "trivy",
      "version": "0.69.3",
      "integration": "code"
    },
    "vulnerabilities": {
      "critical": 0,
      "high": 2,
      "medium": 5,
      "low": 3,
      "total": 10
    },
    "findings": [
      {
        "severity": "high",
        "package": "golang.org/x/net",
        "version": "0.7.0",
        "ecosystem": "gomod",
        "cve": "CVE-2023-44487",
        "title": "HTTP/2 Rapid Reset Attack",
        "fix_version": "0.17.0",
        "fixable": true
      }
    ],
    "summary": {
      "has_critical": false,
      "has_high": true,
      "all_fixable": true
    },
    "native": {
      "trivy": {
        "cicd": {
          "cmds": [
            {"cmd": "trivy fs --scanners vuln .", "version": "0.69.3"}
          ]
        },
        "results": {
          "SchemaVersion": 2,
          "ArtifactName": ".",
          "ArtifactType": "filesystem",
          "Results": [
            {
              "Target": "go.sum",
              "Class": "lang-pkgs",
              "Type": "gomod",
              "Vulnerabilities": [
                {
                  "VulnerabilityID": "CVE-2023-44487",
                  "PkgName": "golang.org/x/net",
                  "InstalledVersion": "0.7.0",
                  "FixedVersion": "0.17.0",
                  "Severity": "HIGH",
                  "Title": "HTTP/2 Rapid Reset Attack",
                  "Description": "The HTTP/2 protocol allows a denial of service...",
                  "References": ["https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],
                  "CVSS": {"nvd": {"V3Score": 7.5}},
                  "CweIDs": ["CWE-400"],
                  "PublishedDate": "2023-10-10T14:15:10Z"
                }
              ]
            }
          ]
        }
      }
    }
  }
}

Configuration Options

SCA Guardrails Inputs

Input	Required	Default	Description
`min_severity`	Optional	`high`	Minimum severity to fail on (critical, high, medium, low)
`max_total_threshold`	Required	—	Maximum total findings allowed (must be configured)
`alert_url`	Required	—	Optional webhook URL. When set, a failing max-severity check also POSTs a JSON payload describing the findings at or above min_severity. Leave empty to disable alerting (default).
`alert_timeout_sec`	Optional	`2`	Webhook POST timeout in seconds. Best-effort — a slow or dead endpoint never changes the check result.

Learn More

Guardrail · SCA Guardrails Max Total View all compatible integrations

→

Collector Trivy Vulnerability Scanner Collector View full documentation

→

Ready to Automate Your Standards?

See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 200+ built-in guardrails.

Works with any process

AI agent rules & prompt files

Post-mortem action items

Security & compliance policies

Testing & quality requirements

Automate Now

Paste your AGENTS.md or manual process doc and get guardrails in minutes

Book a Demo