Merge pull request #2898 from DougAnsonAustinTX/trivy-techreview-1

Trivy techreview

Author: pareenaverma

content/learning-paths/servers-and-cloud-computing/trivy-on-gcpp/_index.md

@@ -1,22 +1,14 @@
 ---
-title: Secure Multi-Architecture Containers with Trivy on Azure Cobalt 100 (Arm64)
-
-draft: true
-cascade:
-    draft: true
+title: Scan multi-architecture containers with Trivy on Azure Cobalt 100
 
 minutes_to_complete: 45
 
-who_is_this_for: This learning path is designed for developers and DevOps engineers who want to integrate security scanning into CI/CD pipelines for multi-architecture container images.
+who_is_this_for: This learning path is for developers and DevOps engineers who want to integrate security scanning into CI/CD pipelines for multi-architecture container images.
 
 learning_objectives:
-    - Provision an Azure Arm64 virtual machine using Azure console, with Ubuntu Pro 24.04 LTS as the base image
-    - Build multi-architecture (amd64/arm64) container images for Azure Cobalt 100
-    - Install and configure Trivy on Arm64 Ubuntu systems
-    - Scan container images for vulnerabilities locally and in CI
-    - Configure self-hosted GitHub Actions Arm runners
-    - Enforce security gates in CI/CD pipelines based on vulnerability severity
-    - Generate and analyze JSON reports for compliance and audit purposes
+    - Build and scan multi-architecture container images using Trivy on Azure Cobalt 100
+    - Configure self-hosted GitHub Actions Arm runners for CI/CD pipelines
+    - Enforce security gates in CI pipelines based on vulnerability severity
 
 prerequisites:
     - A [Microsoft Azure](https://azure.microsoft.com/) account with access to Cobalt 100 based instances (Dpsv6)

content/learning-paths/servers-and-cloud-computing/trivy-on-gcpp/background.md

@@ -14,8 +14,17 @@ To learn more, see the Microsoft blog [Announcing the preview of new Azure virtu
 
 ## Trivy
 
-Trivy is an open-source vulnerability scanner designed to detect security issues in container images, filesystems, and infrastructure configurations. It is widely used in modern DevSecOps workflows to identify known vulnerabilities in operating system packages and application dependencies.
+Trivy is an open-source vulnerability scanner designed to detect security issues in container images, filesystems, and infrastructure configurations. It's widely used in modern DevSecOps workflows to identify known vulnerabilities in operating system packages and application dependencies.
 
 You can use Trivy to perform fast and reliable security scans on container images built for multiple architectures, including Arm64. It helps teams shift security left by detecting vulnerabilities early in the development and CI/CD pipeline.
 
 Learn more at the [Trivy official website](https://trivy.dev/) and in the [Trivy documentation](https://trivy.dev/docs/).
+
+## What you've accomplished and what's next
+
+You now understand the core technologies in this Learning Path:
+
+- Azure Cobalt 100, Microsoft's first-generation Arm-based processor built on Neoverse-N2 architecture
+- Trivy, an open-source security scanner for detecting vulnerabilities in container images
+
+Next, you'll create an Azure Cobalt 100 virtual machine to begin building and scanning multi-architecture container images.

content/learning-paths/servers-and-cloud-computing/trivy-on-gcpp/instance.md

@@ -20,47 +20,61 @@ This Learning Path focuses on general-purpose virtual machines in the Dpsv6 seri
 
 While the steps to create this instance are included here for convenience, you can also refer to the [Deploy a Cobalt 100 virtual machine on Azure Learning Path](/learning-paths/servers-and-cloud-computing/cobalt/).
 
-## Create an Arm-based Azure virtual machine 
+## Create an Arm-based Azure virtual machine
 
-Creating a virtual machine based on Azure Cobalt 100 is no different to creating any other virtual machine in Azure. Follow the steps below to create an Azure virtual machine:
+Creating a virtual machine based on Azure Cobalt 100 is no different to creating any other virtual machine in Azure. To create an Azure virtual machine:
 
 - Launch the Azure portal and navigate to **Virtual Machines**.
 - Select **Create**, and select **Virtual Machine** from the drop-down list.
 - Inside the **Basic** tab, fill in the instance details such as **Virtual machine name** and **Region**.
 - Select the image for your virtual machine (for example, Ubuntu Pro 24.04 LTS) and select **Arm64** as the VM architecture.
-- In the **Size** field, select **See all sizes** and select the D-Series v6 family of virtual machines. 
+- In the **Size** field, select **See all sizes** and select the D-Series v6 family of virtual machines.
 - Select **D4ps_v6** from the list as shown in the diagram below:
 
-![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6) alt-text#center](images/instance.png "Select the D-Series v6 family of virtual machines")
+![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6)#center](images/instance.png "Select the D-Series v6 family of virtual machines")
 
-- For **Authentication type**, select **SSH public key**. {{% notice Note %}}
+- For **Authentication type**, select **SSH public key**.
+
+{{% notice Note %}}
 Azure generates an SSH key pair for you and lets you save it for future use. This method is fast, secure, and easy for connecting to your virtual machine.
 {{% /notice %}}
+
 - Fill in the **Administrator username** for your VM.
-- Select **Generate new key pair**, and select **RSA SSH Format** as the SSH Key Type. {{% notice Note %}}
+- Select **Generate new key pair**, and select **RSA SSH Format** as the SSH Key Type.
+
+{{% notice Note %}}
 RSA offers better security with keys longer than 3072 bits.
-{{% /notice %}} 
+{{% /notice %}}
+
 - Give your SSH key a key pair name.
 - In the **Inbound port rules**, select **HTTP (80)** and **SSH (22)** as the inbound ports, as shown below:
 
-![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6) alt-text#center](images/instance1.png "Allow inbound port rules")
+![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6)#center](images/instance1.png "Allow inbound port rules")
 
 - Now select the **Review + Create** tab and review the configuration for your virtual machine. It should look like the following:
 
-![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6) alt-text#center](images/ubuntu-pro.png "Review and create an Azure Cobalt 100 Arm64 VM")
+![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6)#center](images/ubuntu-pro.png "Review and create an Azure Cobalt 100 Arm64 VM")
 
 - When you are happy with your selection, select the **Create** button and then **Download Private key and Create Resource** button.
 
-![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6) alt-text#center](images/instance4.png "Download private key and create resource")
+![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6)#center](images/instance4.png "Download private key and create resource")
 
 Your virtual machine should be ready and running in a few minutes. You can SSH into the virtual machine using the private key, along with the public IP details.
 
-![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6) alt-text#center](images/final-vm.png "VM deployment confirmation in Azure portal")
+![Azure portal VM creation — Azure Cobalt 100 Arm64 virtual machine (D4ps_v6)#center](images/final-vm.png "VM deployment confirmation in Azure portal")
 
 {{% notice Note %}}
 
 To learn more about Arm-based virtual machine in Azure, see “Getting Started with Microsoft Azure” in [Get started with Arm-based cloud instances](/learning-paths/servers-and-cloud-computing/csp/azure).
 
 {{% /notice %}}
 
-Your Azure Cobalt 100 Arm64 virtual machine is now ready. Continue to the next step to install and configure Trivy.
+## What you've accomplished and what's next
+
+You've successfully:
+
+- Created an Azure Cobalt 100 Arm-based virtual machine using the D-Series v6 (Dpsv6) family
+- Selected Ubuntu Pro 24.04 LTS as the operating system
+- Configured SSH authentication for secure access
+
+Your Azure Cobalt 100 Arm64 virtual machine is now ready. Next, you'll build and scan multi-architecture container images using Docker and Trivy.

content/learning-paths/servers-and-cloud-computing/trivy-on-gcpp/trivy-ci-integration.md

@@ -27,7 +27,8 @@ You will move from local scanning to fully automated security enforcement in CI.
 Ensure that you have:
 
 - Completed the local Trivy scanning module  
-- A GitHub repository  
+- Created a GitHub account and are able to log into it.
+- Created a Docker hub account and are able to log into it.
 - An Azure Cobalt 100 Arm64 Ubuntu VM running  
 - A multi-architecture container image pushed to Docker Hub  
 
@@ -36,19 +37,19 @@ These components are required for building a secure CI pipeline.
 
 ## Create a New GitHub Repository
 
-Open in your browser: https://github.com/new
+Open in your browser: [https://github.com/new](https://github.com/new)
 
 **Fill in:**
 
-- Repository name: trivy-arm-ci-demo (or any name you prefer)
+- Repository name: **trivy-arm-ci-demo**
 - Visibility: Public or Private
 - Do NOT initialize with README (keep it empty)
 
 **Click:**
 
 - Create repository
 
-You now have an empty GitHub repository ready to receive your project files.
+You now have an empty GitHub repository ready to receive your project files. Next lets push our local repo up to github.com.
 
 ## Initialize Git Repository Locally
 
@@ -67,19 +68,22 @@ Turns your local project folder into a Git repository.
 git add .
 git commit -m "Multi-arch nginx image for Trivy scan"
 ```
+
 Stage and save your Dockerfile and demo files into Git history.
 
 **Link Local Repo to GitHub:**
 
+Link your local repo to your github.com repo that you have created. Replace <YOUR_GITHUB_USERNAME> with your GitHub username:
+
 ```bash
 git branch -M main
 git remote add origin https://github.com/<YOUR_GITHUB_USERNAME>/trivy-arm-ci-demo.git
 ```
 
-You can connect your local repository to the remote GitHub repository.
-
 **Push Code to GitHub:**
 
+Finally, push your local repo up to github.com:
+
 ```bash
 git push -u origin main
 ```
@@ -88,7 +92,7 @@ Uploads your project files to GitHub and sets the main branch for future pushes.
 
 ## Setup GitHub Actions Arm Runner
 
-Navigate in GitHub:
+Navigate in the github.com dashboard for your newly created repo:
 
 ```text
 Settings → Actions → Runners → Add Runner  
@@ -102,12 +106,16 @@ GitHub will display setup commands.
 
 This prepares GitHub to register a self-hosted Arm64 runner.
 
-![GitHub Actions Arm64 self-hosted runner connected alt-txt#center](images/arm64-runner.png "Arm64 GitHub Runner Status")
+![GitHub Actions Arm64 self-hosted runner connected#center](images/arm64-runner.png "Arm64 GitHub Runner Status")
+
+Lets step through the steps outlined by the GitHub self-hosted runner setup has provided.
 
 ## Create Runner Directory on VM
 
 Create a workspace for the GitHub runner software.
+
 ```bash
+cd $HOME
 mkdir actions-runner
 cd actions-runner
 ```
@@ -119,19 +127,25 @@ Use the download command provided by GitHub:
 ```bash
 curl -o actions-runner-linux-arm64.tar.gz -L https://github.com/actions/runner/releases/download/v2.331.0/actions-runner-linux-arm64-2.331.0.tar.gz
 tar xzf actions-runner-linux-arm64.tar.gz
+rm ./actions-runner-linux-arm64.tar.gz
 ```
+
 Downloads and extracts the Arm64-compatible runner.
 
 **Configure Runner:**
 
+Run the configuration script to configure the Runner. This command is also shown in the GitHub runner setup page and can be simply copied/pasted:
+
 ```bash
 ./config.sh --url https://github.com/<USERNAME>/<REPO> --token <TOKEN>
 ```
 
-Registers the runner with your GitHub repository.
+Press "Enter" when asked during the configuration steps to choose the defaults.
 
 **Start Runner:**
 
+Lets run the runner now!
+
 ```bash
 ./run.sh
 ```
@@ -147,34 +161,31 @@ Current runner version: '2.331.0'
 
 **In your GitHub repository:**
 
-```text 
-Settings → Secrets → Actions → New repository secret
+```text
+Settings → Secrets and Variables → Actions → New repository secret
 ```
-Add the following secrets:
 
-| Name              | Value                               |
-| ----------------- | ----------------------------------- |
-| `DOCKER_USERNAME` | Your Docker Hub username            |
-| `DOCKER_PASSWORD` | Docker Hub password or access token |
-| `IMAGE_NAME`      | trivy-multiarch-nginx               |
-| `IMAGE_TAG`       | latest                              |
+Add the following secrets using your Docker Hub username Docker Hub generated personal access token with "RO" authorization:
+
+| Name              | Value                            |
+| ----------------- | -------------------------------- |
+| `DOCKER_USERNAME` | Your Docker Hub username         |
+| `DOCKER_PASSWORD` | Docker Hub personal access token |
+| `IMAGE_NAME`      | trivy-multiarch-nginx            |
+| `IMAGE_TAG`       | latest                           |
 
-![GitHub Actions secrets configuration alt-txt#center](images/secrets.png "GitHub Secrets Configuration")
+![GitHub Actions secrets configuration#center](images/secrets.png "GitHub Secrets Configuration")
 
 ## Create CI Workflow
-Create Workflow Directory
 
-```bash
-mkdir -p .github/workflows
-```
-**Create file:**
+In an additional SSH shell, create a Workflow directory:
 
 ```bash
-nano .github/workflows/trivy-scan.yml
+mkdir -p $HOME/trivy-multiarch-demo/.github/workflows
+cd $HOME/trivy-multiarch-demo
 ```
 
-Add:
-Defines a CI pipeline that scans images on every push.
+Edit a file named **$HOME/trivy-multiarch-demo/.github/workflows/trivy-scan.yml** with the following content:
 
 ```yaml
 name: Trivy Scan on Arm Runner
@@ -233,11 +244,18 @@ git add .
 git commit -m "Add Trivy scan on Arm runner"
 git push origin main
 ```
-Push triggers GitHub Actions automatically.
+
+Push triggers GitHub Actions automatically. You should also see output from the ./run.sh command running in the other SSH shell that resembles:
+
+```output
+026-02-17 16:09:52Z: Listening for Jobs
+2026-02-17 16:15:27Z: Running job: security-scan
+2026-02-17 16:15:35Z: Job security-scan completed with result: Failed
+```
 
 ## Verify CI Execution (Trivy Security Gate on Arm Runner)
 
-After pushing your code to GitHub, navigate to:
+After pushing your code to GitHub, on the github web dashboard, navigate to:
 
 ```text
 GitHub → Actions → Trivy Scan on Arm Runner
@@ -247,7 +265,7 @@ Select the latest workflow run.
 
 Expected Results:
 
-![GitHub Actions Trivy security scan workflow execution log alt-txt#center](images/security-scan.png "Trivy CI Security Scan Execution")
+![GitHub Actions Trivy security scan workflow execution log#center](images/security-scan.png "Trivy CI Security Scan Execution")
 
 You should observe the following:
 
@@ -282,33 +300,47 @@ This means:
 This is known as a security gate.
 
 ## Understanding the CI Scan Result
-Is This Behavior Good or Bad?
 
-- This behavior is GOOD and expected in real-world CI/CD pipelines
+### Is This Behavior Good or Bad?
+
+This behavior is GOOD and expected in real-world CI/CD pipelines.
 
 Modern DevSecOps practices integrate security tools like Trivy directly into Continuous Integration to automatically detect vulnerabilities.
 
 The pipeline is designed to:
 
 - Stop insecure container images early in the development lifecycle
--Prevent vulnerable software from reaching staging or production environments
+- Prevent vulnerable software from reaching staging or production environments
 - Enforce security and compliance policies automatically
 
-**What a Failing Pipeline Means**
+### What a Failing Pipeline Means
 
 When the Trivy scan fails the job:
 
 - Trivy successfully detected HIGH or CRITICAL vulnerabilities in the container image
 - The security gate blocked the insecure image
 - The CI pipeline protected downstream environments
 
-**Why This Matters in Enterprise CI/CD**
+### Why This Matters in Enterprise CI/CD
 
 In enterprise environments, automated security enforcement is mandatory.
 
-- Failing fast on vulnerabilities ensures:
+Failing fast on vulnerabilities ensures:
+
 - Faster remediation
 - Reduced security risk
 - Strong compliance posture
 
 This behavior confirms that your Arm-based CI pipeline is working correctly.
+
+## What you've accomplished and what's next
+
+You've successfully:
+
+- Set up a self-hosted GitHub Actions runner on Azure Cobalt 100 Arm64
+- Configured GitHub secrets for secure authentication
+- Created a CI/CD pipeline that automatically scans container images with Trivy
+- Implemented security gates that fail builds when HIGH or CRITICAL vulnerabilities are detected
+- Generated and uploaded vulnerability reports as CI artifacts
+
+You now have a complete DevSecOps workflow that runs natively on Arm infrastructure. This setup enables you to shift security left in your development process, catching vulnerabilities before they reach production environments. You can extend this workflow by adding remediation steps, integrating with notification systems, or customizing the security policies to match your organization's requirements.