Scan requirements.txt files with different name

[naortalmor1]

Description

I have a file called dev-requirements.txt and I would love trivy to scan the dependencies in this file as well.

Suggestion:

• Pick up all files called *requirements.txt, check if the format meet the requirements.txt, if it is - scan for vulns

Target

Filesystem

Scanner

Vulnerability

[knqyf263]

Did you try --file-patterns? Something like trivy repo --file-patterns 'pip:*requirements.txt'.

[michal-michalak]

For the ones looking for a solution:

tree requirements
requirements
├── base.txt
├── dev.txt
├── local.txt
└── prod.txt

That command should do the job:

docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ./.cache/:/root/.cache/ \
  -v $PWD:/app aquasec/trivy fs --scanners vuln --dependency-tree --file-patterns 'pip:.*.txt' /app/requirements/

[nikpivkin]

Also a page on documentation https://trivy.dev/latest/docs/configuration/skipping/#file-patterns