Adding security scanning (Trivy, gitleaks, CodeQL) to CI
Why it matters
A scanner in the pipeline catches a vulnerable dependency, a leaked key or a dangerous pattern in the pull request — where fixing it costs one commit, not an incident.
How to fix it
Add a scanning step to CI. Free options: Trivy for images and dependencies, gitleaks for secrets, CodeQL for code. Each is a single job in your existing workflow.
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.