yaml 10 lines · 1 tab

Trivy image scanning in pull request pipelines

Kai Nakamura Apr 2026

1 tab

- name: Build image
  run: docker build -t app:${{ github.sha }} .

- name: Scan image
  uses: aquasecurity/trivy-action@0.24.0
  with:
    image-ref: app:${{ github.sha }}
    severity: HIGH,CRITICAL
    exit-code: '1'
    ignore-unfixed: true

1 file · yaml Explain with highlit

I scan container images before they ever reach a registry promotion step. Trivy gives quick visibility into OS packages, language dependencies, and misconfiguration issues in IaC. The important part is failing only on risk that the team is prepared to fix, otherwise the scan turns into wallpaper.

Related snips

yaml

name: semgrep

on: [pull_request]

jobs:
  scan:

Static application security testing with Semgrep in CI

semgrep sast ci

by Kai Nakamura 1 tab

javascript

const withBundleAnalyzer = require('@next/bundle-analyzer')({
  enabled: process.env.ANALYZE === 'true',
  openAnalyzer: true,
});

/** @type {import('next').NextConfig} */

Next.js bundle analyzer for targeted performance work

nextjs performance tooling

by codesnips 4 tabs

ruby

class ExplainAnalyzer
  def initialize(relation, watched_tables:)
    @relation = relation
    @watched_tables = Array(watched_tables).map(&:to_s)
  end

Fast Fail for Missing Indexes (EXPLAIN sanity check)

rails postgres performance

by codesnips 3 tabs

bash

#!/usr/bin/env bash
# Docker Networking Modes & Configuration

# === List networks ===
docker network ls
docker network inspect bridge

Docker networking: bridge, host, and overlay networks

docker networking containers

by Ryan Nakamura 1 tab

typescript

import { defineConfig, devices } from '@playwright/test';
import path from 'node:path';

export const authFile = path.join(__dirname, '.auth/user.json');

export default defineConfig({

Playwright smoke test for auth flow

testing playwright e2e

by codesnips 4 tabs

dockerfile

FROM node:20-alpine AS base
WORKDIR /app
RUN apk add --no-cache libc6-compat

FROM base AS deps
COPY package.json package-lock.json ./

Docker multi-stage build for Next.js

docker nextjs multi-stage

by codesnips 4 tabs

Share this code

Here's the card — post it anywhere.

Trivy image scanning in pull request pipelines — share card

Link copied