sca
Run Software Composition Analysis (SCA)
Synopsis
Run a Software Composition Analysis (SCA) for a project or container image.
This command can accept either an OCI image reference (e.g. ghcr.io/org/image:tag) via --image or as the first positional argument, or a local path/tar file via --path or as the first positional argument. The command will generate or accept an SBOM, upload it to DevGuard and return vulnerability results.
Any flags after a "--" separator are forwarded verbatim to the underlying trivy invocation. See the trivy CLI reference for available flags: https://trivy.dev/docs/latest/guide/references/configuration/cli/trivy/