Skip to content

docs: expand proactive SCA section — Trivy prerequisite and setup paths #2690

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
claudiacodacy merged 9 commits into from
Jun 22, 2026
Merged

docs: expand proactive SCA section — Trivy prerequisite and setup paths #2690

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
299072a
docs: expand proactive SCA section — Trivy prerequisite, setup paths,…
claudiacodacy Jun 22, 2026
0f8cbe0
docs: remove redundant admonition — requirements list is self-evident
claudiacodacy Jun 22, 2026
a36a338
docs: rework SCA intro, remove inaccurate last sentence, add Dependen…
claudiacodacy Jun 22, 2026
2308608
docs: fix Business tier → business-tier (hyphen, consistent with rest…
claudiacodacy Jun 22, 2026
c276b65
docs: fold upgrade CTA inline, expand pattern list to sub-bullets
claudiacodacy Jun 22, 2026
3377f24
docs: move Trivy requirements to Dependencies section, collapse SCA f…
claudiacodacy Jun 22, 2026
d5d6ad1
docs: move page access instruction before requirements subsection
claudiacodacy Jun 22, 2026
0a149b3
Revert "docs: move page access instruction before requirements subsec…
claudiacodacy Jun 22, 2026
82a9985
docs: add 'Viewing your dependencies' heading before access sentence
claudiacodacy Jun 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 22 additions & 10 deletions docs/organizations/managing-security-and-risk.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,15 +189,9 @@

### How Codacy manages findings detected during software composition analysis (SCA) {: id="opening-and-closing-sca-items"}

!!! note
To make sure that Codacy detects dependency issues correctly, [enable code patterns](../repositories-configure/configuring-code-patterns.md) belonging to the Trivy tool.

Vulnerable dependencies are a specific GIT repository finding. Similarly to other repository findings, Codacy opens an issue whenever a commit is analyzed.
SCA findings behave like other Git repository findings. Codacy opens a finding whenever a commit to the default branch is analyzed and a vulnerable dependency is detected, and closes it when the dependency is no longer detected.

Additionally, Codacy scans your codebase every evening to see if it's affected by any newly discovered vulnerabilities.

!!! important
The proactive SCA scanning is a business tier feature. If you are a Codacy Pro customer interested in upgrading to gain access to this feature, reach out to our customer success team.
On the Business plan, Codacy also runs [daily re-scans](#proactive-sca-requirements) across all repositories — so newly discovered vulnerabilities are surfaced even without a new commit. [Talk to us](https://start-chat.com/slack/codacy/rmbTzb) if you're interested in upgrading.

Check failure on line 194 in docs/organizations/managing-security-and-risk.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Microsoft.Dashes] Remove the spaces around ' — '.

Raw Output:
{"message": "[Microsoft.Dashes] Remove the spaces around ' — '.", "location": {"path": "docs/organizations/managing-security-and-risk.md", "range": {"start": {"line": 194, "column": 109}}}, "severity": "ERROR"}


### How Codacy manages findings detected on Jira {: id="opening-and-closing-jira-items"}
Expand Down Expand Up @@ -569,10 +563,28 @@
## Dependencies {: id="dependencies-list"}

!!! important
The dependency tab is a business-tier feature. If you are a Codacy Pro customer interested in upgrading to gain access to this feature, contact our customer success team.
The dependency tab is a business-tier feature. If you are a Codacy Pro customer interested in upgrading to gain access to this feature, [talk to us](https://start-chat.com/slack/codacy/rmbTzb).

The **Security and risk management Dependencies** page displays a unified view of all dependencies used by your repositories, populated by Codacy's daily SCA re-scans.

### Daily re-scan requirements {: id="proactive-sca-requirements"}

Proactive SCA uses **Trivy** as its scanning tool. For daily re-scans to produce results on a repository, **both** conditions must be met:

1. The **Trivy tool** is enabled — either through a [coding standard](using-coding-standards.md) applied to the repository, or directly via the repository's [Code patterns settings](../repositories-configure/configuring-code-patterns.md).

Check failure on line 574 in docs/organizations/managing-security-and-risk.md

View workflow job for this annotation

GitHub Actions / vale 

[vale] reported by reviewdog 🐶
[Microsoft.Dashes] Remove the spaces around ' — '.

Raw Output:
{"message": "[Microsoft.Dashes] Remove the spaces around ' — '.", "location": {"path": "docs/organizations/managing-security-and-risk.md", "range": {"start": {"line": 574, "column": 33}}}, "severity": "ERROR"}
2. At least one **Trivy vulnerability pattern** is enabled:
- `Trivy_vulnerability_critical`
- `Trivy_vulnerability_high`
- `Trivy_vulnerability_medium`
- `Trivy_vulnerability_minor`
- `Trivy_malicious_packages`

To enable Trivy across your organization, you can:

- **Recommended — via coding standard:** [Add Trivy to a coding standard](using-coding-standards.md), enable its vulnerability patterns in the standard configuration, and apply the standard to your repositories. This covers all linked repositories in one step.
- **Per repository:** Open each repository's [Code patterns page](../repositories-configure/configuring-code-patterns.md), enable the Trivy tool, and enable the relevant vulnerability patterns.

The **Security and risk management Dependencies** page displays a unified view of all dependencies used by your repositories.
### Viewing your dependencies

To access the dependencies page, access the [overview page](#dashboard) and click the **Dependencies** tab.

Expand Down
Loading