How to Fix Jenkins Trivy Scan

In this tutorial, you'll learn about How to Fix Jenkins Trivy Scan. We cover key concepts, practical examples, and best practices.

The Problem

Your Jenkins trivy scan configuration is broken. The pipeline fails with cryptic errors, or the feature does not behave as documented.

Jenkins is a powerful automation server, but its trivy scan settings can be tricky. Misconfiguration leads to build failures, wasted hours, and unreliable pipelines. At DodaTech, we maintain hundreds of Jenkins pipelines for CI/CD automation. Here is how we fix this.

Error Symptoms

You see errors like:

[Pipeline] End of Pipeline
ERROR: 860dd1833428 Jenkins trivy-scan failed
Finished: FAILURE

Wrong Configuration

This is the incorrect trivy scan setup:

// Wrong: incorrect trivy-scan in Jenkinsfile
pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                echo 'Building...'
            }
        }
    }
    // Missing proper trivy-scan configuration
}

The problem is that the trivy scan settings are not defined, so Jenkins uses default values that may not match your environment. This causes silent failures that are difficult to trace.

Pipeline output:

[Pipeline] echo
Building...
[Pipeline] End of Pipeline
ERROR: Stage 'Build' failed due to missing trivy-scan configuration

Right Configuration

Here is the correct trivy scan configuration:

// Correct: proper trivy-scan setup
pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                echo 'Building...'
                sh '''
                    make build
                    make test
                '''
            }
        }
    }
    post {
        always {
            cleanWs()
        }
        success {
            echo 'trivy-scan completed successfully'
        }
        failure {
            echo 'trivy-scan failed - check logs'
        }
    }
}

Expected output:

[Pipeline] echo
Building...
[Pipeline] sh
make build
make test
[Pipeline] cleanWs
[Pipeline] echo
trivy-scan completed successfully
[Pipeline] End of Pipeline
Finished: SUCCESS

Prevention

• Validate Jenkinsfile syntax before committing using the Pipeline Syntax Checker
• Use the Jenkins Blue Ocean UI for visual pipeline debugging and log inspection
• Store all credentials in Jenkins credential store using withCredentials binding
• Pin plugin versions in your Jenkins configuration to avoid breaking changes
• Use shared libraries to centralize common pipeline logic across teams
• Review Kubernetes agent logs when using dynamic pod templates
• Implement proper error handling with try/catch blocks in scripted pipelines
• Monitor Jenkins master health with the Monitoring plugin and set up alerts

Common Mistakes with trivy scan

1. Using head and tail instead of pattern matching, causing runtime errors on empty lists
2. Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks
3. Using return to exit a function early instead of wrapping a pure value in the monad

These mistakes appear frequently in real-world JENKINS code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ