run2-trivy-offline

name	run2_trivy-offline
description	Optimized Trivy offline scanning for lock files, including all dependency types.

Optimized Trivy Offline Scanning

This skill covers enhanced offline scanning techniques using Trivy.

Scanning All Dependencies

By default, Trivy might skip dev dependencies. For a complete audit of a package-lock.json, use the --include-dev-deps flag.

trivy fs /path/to/target \
  --format json \
  --output report.json \
  --scanners vuln \
  --include-dev-deps \
  --skip-db-update \
  --offline-scan \
  --cache-dir /path/to/trivy/cache

Troubleshooting Database Issues

If the scan fails due to database initialization, verify the path:

1. Ensure trivy.db is in <cache-dir>/db/.
2. Ensure the user has read permissions to the database file.