Trivy Report Formats: JSON, CycloneDX, SPDX, and SARIF Explained

Trivy supports nine built-in output formats ranging from human-readable tables to standardized machine-readable specifications like CycloneDX and SARIF, with format selection logic centralized in pkg/report/writer.go and constants defined in pkg/types/report.go.

Trivy, the comprehensive vulnerability scanner from Aqua Security, provides flexible output options to integrate with CI/CD pipelines, SBOM tools, and security dashboards. Understanding the available Trivy report formats allows teams to automate compliance workflows and feed scan results directly into vulnerability management systems. This guide examines the nine built-in formats defined in the aquasecurity/trivy repository, their implementation details, and practical usage examples.

Core Report Format Constants in Trivy

Trivy defines all supported output formats as typed constants in pkg/types/report.go. The Format type serves as the single source of truth for valid output options, exposed through the SupportedFormats slice that the CLI validates against.

The complete list of format constants includes:

• FormatTable – Human-friendly tabular output printed to stdout
• FormatJSON – Pretty-printed JSON containing the full Report structure
• FormatTemplate – Custom Go template output via the --template flag
• FormatSarif – SARIF (Static Analysis Results Interop Format) for IDE integration
• FormatCycloneDX – CycloneDX SBOM in JSON format
• FormatSPDX – SPDX tag/value format (legacy)
• FormatSPDXJSON – SPDX JSON format (standardized)
• FormatGitHub – GitHub-specific SARIF-compatible output for the Security tab
• FormatCosignVuln – Cosign vulnerability predicate format for signed SBOMs

These constants map directly to writer implementations dispatched at runtime.

How Trivy Dispatches Report Writers

When Trivy executes a scan, the selected format determines which writer implementation instantiates the output. This dispatch logic resides in pkg/report/writer.go, where a switch statement on option.Format routes to the appropriate encoder:

switch option.Format {
case types.FormatTable:
    writer = table.NewWriter(table.Options{...})
case types.FormatJSON:
    writer = &JSONWriter{Output: output, ReportOptions: opts}
case types.FormatGitHub:
    writer = &github.Writer{sarifWriter: sarifWriter}
case types.FormatCycloneDX:
    writer = cyclonedx.NewWriter(output, option.AppVersion, option.OS)
case types.FormatSPDX, types.FormatSPDXJSON:
    writer = spdx.NewWriter(output, option.AppVersion, option.Format)
case types.FormatTemplate:
    writer = &TemplateWriter{Output: output, Template: option.Template}
case types.FormatSarif:
    writer = &SarifWriter{Output: output, ...}
case types.FormatCosignVuln:
    writer = predicate.NewVulnWriter(output, option.AppVersion, option.CLIOptions)
default:
    return xerrors.Errorf("unknown format: %v", option.Format)
}

Each writer lives in a dedicated package under pkg/report/, handling format-specific marshaling logic.

Machine-Readable Trivy Report Formats

Trivy excels at producing standardized machine-readable outputs that integrate with third-party security and compliance tools. The following sections detail the primary specifications.

JSON Output Format

The JSON format provides the complete vulnerability report structure with indentation for readability. The JSONWriter in pkg/report/json.go marshals the types.Report struct using json.MarshalIndent, preserving all metadata including OS packages, library dependencies, and misconfigurations.

trivy image --format json --output report.json nginx:latest

CycloneDX SBOM Format

CycloneDX is a lightweight Software Bill of Materials (SBOM) standard designed for security use cases. The cyclonedx.NewWriter function in pkg/report/cyclonedx/cyclonedx.go generates JSON documents compliant with the CycloneDX specification, listing components and their vulnerabilities.

trivy image --format cyclonedx --output sbom.cdx.json nginx:latest

SPDX Format Options

Trivy supports two SPDX output variants defined in pkg/report/spdx/spdx.go: the legacy tag/value format (FormatSPDX) and the standardized JSON format (FormatSPDXJSON). The spdx.NewWriter accepts the format constant to determine serialization style.

# SPDX JSON (recommended)

trivy image --format spdx-json --output sbom.spdx.json nginx:latest

# SPDX tag-value (legacy)

trivy image --format spdx --output sbom.spdx nginx:latest

SARIF for Static Analysis Integration

The SARIF (Static Analysis Results Interop Format) output enables integration with GitHub Advanced Security, Azure DevOps, and VS Code. Implemented in pkg/report/sarif.go, the SarifWriter structures vulnerability locations and severity levels according to the SARIF 2.1.0 specification.

trivy image --format sarif --output report.sarif nginx:latest

GitHub and Cosign Vuln Formats

Beyond standard specifications, Trivy provides specialized formats for modern DevSecOps workflows. The FormatGitHub constant triggers the writer in pkg/report/github.go, producing SARIF optimized for GitHub's Security tab. For supply chain security, FormatCosignVuln (implemented in pkg/report/predicate.go) generates Cosign-compatible vulnerability predicates for signing and verifying SBOM attestations.

Generating Trivy Reports from the CLI

All formats are accessible via the --format flag across Trivy subcommands (image, filesystem, repository, etc.). The CLI validates input against the SupportedFormats slice before execution.

Common usage patterns:

# Human-readable table (default)

trivy image nginx:latest

# Full JSON report for automation

trivy fs --format json --output trivy-report.json .

# CycloneDX SBOM for compliance

trivy repo --format cyclonedx --output sbom.json https://github.com/org/repo

# SARIF for GitHub Actions integration

trivy image --format sarif --output trivy-results.sarif alpine:latest

Programmatic Report Generation with the Go API

Developers embedding Trivy can generate reports programmatically using the report.Write function. The flag.Options struct (defined in pkg/flag/flag.go) specifies the format and output destination, mirroring CLI behavior.

package main

import (
    "context"
    "os"

    "github.com/aquasecurity/trivy/pkg/report"
    "github.com/aquasecurity/trivy/pkg/types"
    "github.com/aquasecurity/trivy/pkg/flag"
)

func main() {
    // Assume reportData is populated from a scan
    var reportData types.Report

    opts := flag.Options{
        Format: types.FormatJSON,      // or FormatCycloneDX, FormatSarif, etc.
        Output: "scan-results.json",
    }

    ctx := context.Background()
    if err := report.Write(ctx, reportData, opts); err != nil {
        panic(err)
    }
}

The Write function internally dispatches to the appropriate writer implementation based on opts.Format.

Summary

• Trivy defines nine built-in report formats as constants in pkg/types/report.go, ranging from human-readable tables to machine-readable SBOM standards.
• Format selection logic resides in pkg/report/writer.go, which instantiates specialized writers including JSONWriter, SarifWriter, and cyclonedx.Writer.
• Standardized formats include CycloneDX (SBOM), SPDX (tag/value and JSON), and SARIF (static analysis), enabling integration with GitHub, Azure DevOps, and compliance tools.
• Specialized formats like FormatGitHub and FormatCosignVuln support DevSecOps workflows including signed attestations and GitHub Security tab integration.
• Both CLI (--format) and Go API (report.Write) interfaces accept these format constants, with validation against the SupportedFormats slice.

Frequently Asked Questions

What is the default report format in Trivy?

The default format is FormatTable, which produces human-readable tabular output printed directly to stdout. This format is defined in pkg/types/report.go and instantiated via table.NewWriter in pkg/report/writer.go when no --format flag is specified.

How do I generate a CycloneDX SBOM with Trivy?

Use the --format cyclonedx flag with any scan target. Trivy marshals the component inventory and vulnerability data using the cyclonedx.NewWriter in pkg/report/cyclonedx/cyclonedx.go, outputting a valid CycloneDX JSON document suitable for SBOM repositories and compliance audits.

Can Trivy output SPDX 2.3 JSON format?

Yes. Specify --format spdx-json to generate SPDX in JSON format. The spdx.NewWriter in pkg/report/spdx/spdx.go handles both the legacy tag/value format (spdx) and the standardized JSON format (spdx-json), with the latter conforming to SPDX 2.3 specifications.

Which Trivy format should I use for GitHub Advanced Security?

Use --format sarif or --format github. The standard SARIF format (sarif) works with any SARIF-compatible tool, while the GitHub-specific format (github) is optimized for the GitHub Security tab and code scanning alerts, implemented in pkg/report/github.go.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}