Repository navigation
Replace Snyk scans with Trivy - #1090
Merged
Merged
Conversation
pvannierop
requested review from
mpgxvii,
peyman-mohtashami and
yatharthranjan
as code owners
October 1, 2026 08:10
- trivy.yaml: PR gate on fixable HIGH/CRITICAL findings (was snyk.yaml with --severity-threshold=high --fail-on=upgradable), plus a job summary with all findings - scheduled-trivy.yaml: weekly code base scan, SARIF to Code scanning - scheduled-trivy-docker.yaml: weekly base image scan (OS packages, like Snyk's --exclude-app-vulns), SARIF to Code scanning - .github/trivy-lock.init.gradle: locks runtimeClasspath, so Trivy can read the Gradle dependencies - .trivyignore.yaml: empty ignore list (Trivy 0.74 needs the file to exist) - Remove .snyk. Its ignores were only meant to quiet Snyk until this move, so they are not carried over and Trivy reports those findings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Locking only needs the dependency graph, not the files. Resolving files fails in multi-module Android builds (radar-commons-android), and the lock script is kept the same in every RADAR-base repo. On this build the lockfile is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pvannierop
force-pushed
the
ci/snyk-to-trivy
branch
from
October 5, 2026 11:24
0730d3b to
ab95780
Compare
After the 2026-09-23 security fixes (#1086), the Trivy gate still finds 26 HIGH/CRITICAL vulnerabilities whose fixes are only in new major versions: - Spring Boot 2.7 / Spring 5.3 / Spring Security 5.7 / Spring Data 2.7: fixed only in the Spring Boot 3 line (Spring Security's 5.7.16 and 5.8.18 fixes are commercial; public 5.8 ends at 5.8.16) - snakeyaml 1.33: fixed only in 2.0, which Spring Boot 2.7 doesn't support - Angular 12: fixed only in Angular 19.2+/20+ Ignore them until 2027-04-05, with the reason per entry. They need the Spring Boot 3 and Angular migrations.
this-Aditya
approved these changes
Oct 5, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the Snyk GitHub Actions scans with Trivy, as part of the move away from Snyk across RADAR-base.
snyk.yaml: PR gate,--severity-threshold=high --fail-on=upgradabletrivy.yaml: PR gate on fixable HIGH/CRITICAL findings (--severity HIGH,CRITICAL --ignore-unfixed), plus a job summary that lists every finding at every severityscheduled-snyk.yaml: weekly scan, SARIF uploadscheduled-trivy.yaml: weekly scan of all severities, SARIF to Code scanning (categorytrivy-dependencies)scheduled-snyk-docker.yamlscheduled-trivy-docker.yaml: weekly base image scan (--pkg-types os).snyk.trivyignore.yaml(no entries; the file must exist for Trivy 0.74)Gradle dependencies are visible to Trivy only through lockfiles, so the workflows first lock
runtimeClasspathwith.github/trivy-lock.init.gradle, the same classpath the Snyk gate scanned (--configuration-matching="^runtimeClasspath$"). Build tooling and test dependencies don't fail the gate. Actions are pinned by commit SHA and Trivy to v0.74.0.Snyk ignores are not carried over: they were added to quiet Snyk until this move, so Trivy reports those findings.
Local dry run on
dev(Trivy 0.74.0): all: {'MEDIUM': 50, 'LOW': 11, 'HIGH': 50, 'CRITICAL': 9}, gate (fixable HIGH/CRITICAL): {'HIGH': 48, 'CRITICAL': 9}.Merge this after the security PR #1086: until then
devstill has the old dependency versions, so this PR's own Trivy check is expected to fail.🤖 Generated with Claude Code