Trivy license scan "FAILED" at severity threshold in CI

By Daniel Zoghalchali·Latchkey

Trivy license scanning found a package or file license classified at a severity you configured to fail on (for example a restricted license like GPL), and with --exit-code 1 it returned non-zero to block the pipeline.

What this error means

Trivy prints a License table with a FAILED status and a severity (CRITICAL/HIGH for restricted licenses), then exits 1 because --scanners license plus an exit-code and severity threshold matched.

Package                License    Classification    Severity
some-lib               GPL-3.0    restricted        HIGH

Trivy exited with code 1 (license severity threshold HIGH matched)

Common causes

A restricted license met the severity gate

Trivy classifies licenses (forbidden, restricted, reciprocal, notice, permissive) and maps them to severities. A restricted license at or above your --severity fails when --exit-code is set.

License scanning was enabled with a strict threshold

You ran --scanners license (or license scanning in the config) with a low severity threshold, so more license categories count as failures.

How to fix it

Review the license and adjust the gate

1. Run Trivy with --scanners license and no exit code to see the full table.
2. Confirm the package and its license classification.
3. Replace the dependency, or reclassify the license in a Trivy config if approved.

trivy fs --scanners license --severity HIGH,CRITICAL \
  --exit-code 1 .

Reclassify an approved license

If legal has cleared a specific license, move it to a lower category in a Trivy config file so it no longer meets the failing severity.

# trivy.yaml
license:
  ignored:
    - GPL-3.0

How to prevent it

• Keep the license severity threshold aligned with your policy.
• Maintain a reviewed ignore/reclassify list instead of disabling the scanner.
• Run license scanning on PRs so restricted licenses surface early.

Frequently asked questions

Related guides

References

• GitHub Actions documentation