War Story: We Saved 40% on Container Scanning Costs by Replacing Snyk 2026 with Trivy 0.50

# .github/workflows/container-scan-trivy.yml
# Replaces legacy Snyk 2026 scanning workflow with Trivy 0.50
# Includes error handling, result parsing, and Slack alerting
name: Container Security Scan (Trivy)
on:
  push:
    branches: [ main, release/* ]
  pull_request:
    branches: [ main ]

env:
  TRIVY_VERSION: 0.50.0
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SECURITY_WEBHOOK }}
  SNYK_LEGACY_SCAN_FILE: scans/snyk-legacy-results.json
  TRIVY_SCAN_FILE: scans/trivy-results.sarif

jobs:
  trivy-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      packages: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Trivy 0.50.0
        run: |
          # Download Trivy binary with checksum verification
          TRIVY_CHECKSUM="a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456"
          curl -sSfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v${{ env.TRIVY_VERSION }}
          # Verify installed version matches target
          INSTALLED_VERSION=$(trivy --version | head -n 1 | awk '{print $2}')
          if [ "$INSTALLED_VERSION" != "v${{ env.TRIVY_VERSION }}" ]; then
            echo "::error::Installed Trivy version $INSTALLED_VERSION does not match target v${{ env.TRIVY_VERSION }}"
            exit 1
          fi
          # Verify binary checksum
          COMPUTED_CHECKSUM=$(sha256sum /usr/local/bin/trivy | awk '{print $1}')
          if [ "$COMPUTED_CHECKSUM" != "$TRIVY_CHECKSUM" ]; then
            echo "::error::Trivy binary checksum mismatch. Expected $TRIVY_CHECKSUM, got $COMPUTED_CHECKSUM"
            exit 1
          fi

      - name: Run Trivy scan on container image
        id: trivy-scan
        run: |
          # Build image tag from git SHA
          IMAGE_TAG="ghcr.io/${{ github.repository }}:${{ github.sha }}"
          # Create scan output directory
          mkdir -p scans
          # Run Trivy scan with SARIF output for GitHub Security tab
          trivy image \
            --format sarif \
            --output ${{ env.TRIVY_SCAN_FILE }} \
            --severity CRITICAL,HIGH \
            --ignore-unfixed \
            --cache-dir ~/.cache/trivy \
            $IMAGE_TAG
          # Capture exit code (non-zero if vulnerabilities found)
          SCAN_EXIT_CODE=$?
          echo "scan-exit-code=$SCAN_EXIT_CODE" >> $GITHUB_OUTPUT
          # Also output JSON for legacy Snyk result comparison
          trivy image \
            --format json \
            --output ${{ env.SNYK_LEGACY_SCAN_FILE }} \
            --severity CRITICAL,HIGH \
            --ignore-unfixed \
            $IMAGE_TAG
          exit 0  # Don't fail workflow here, handle results in next step

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ${{ env.TRIVY_SCAN_FILE }}
          category: trivy-container-scan

      - name: Compare with legacy Snyk results (benchmark only)
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          # Compare Trivy results with last Snyk scan for regression testing
          python3 scripts/compare_scan_results.py \
            --snyk-file ${{ env.SNYK_LEGACY_SCAN_FILE }} \
            --trivy-file ${{ env.TRIVY_SCAN_FILE }} \
            --output scans/comparison-report.json
          # Fail if Trivy detects less than 95% of Snyk's critical vulnerabilities
          CRITICAL_MATCH=$(jq '.critical_match_percentage' scans/comparison-report.json)
          if (( $(echo "$CRITICAL_MATCH < 95" | bc -l) )); then
            echo "::error::Trivy detected only $CRITICAL_MATCH% of Snyk's critical vulnerabilities"
            exit 1
          fi

      - name: Send Slack alert on critical vulnerabilities
        if: steps.trivy-scan.outputs.scan-exit-code != 0
        uses: slackapi/slack-github-action@v1.25.0
        with:
          payload: |
            {
              "text": "🚨 Critical/high vulnerabilities detected in container image ${{ github.sha }}",
              "attachments": [
                {
                  "color": "#ff0000",
                  "fields": [
                    { "title": "Image", "value": "ghcr.io/${{ github.repository }}:${{ github.sha }}", "short": false },
                    { "title": "Scan Results", "value": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}", "short": false }
                  ]
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ env.SLACK_WEBHOOK_URL }}

      - name: Fail workflow on critical vulnerabilities
        if: steps.trivy-scan.outputs.scan-exit-code != 0
        run: |
          echo "::error::Critical or high severity vulnerabilities detected. Failing deployment."
          exit 1

# scripts/compare_scan_results.py
# Compares legacy Snyk 2026 scan results with Trivy 0.50 results
# Outputs match percentages for critical, high, medium severity vulnerabilities
# Includes error handling for missing files, invalid JSON, and schema mismatches

import argparse
import json
import sys
from typing import Dict, List, Set

# Snyk 2026 JSON output schema (simplified)
SNYK_SEVERITY_MAP = {
    "critical": "critical",
    "high": "high",
    "medium": "medium",
    "low": "low"
}

# Trivy 0.50 JSON output schema (simplified)
TRIVY_SEVERITY_MAP = {
    "CRITICAL": "critical",
    "HIGH": "high",
    "MEDIUM": "medium",
    "LOW": "low"
}

def load_json_file(file_path: str) -> Dict:
    """Load and parse a JSON file, with error handling for IO and parse errors."""
    try:
        with open(file_path, 'r') as f:
            return json.load(f)
    except FileNotFoundError:
        print("::error::File not found: {file_path}", file=sys.stderr)
        sys.exit(1)
    except json.JSONDecodeError as e:
        print("::error::Invalid JSON in {file_path}: {str(e)}", file=sys.stderr)
        sys.exit(1)
    except Exception as e:
        print("::error::Failed to load {file_path}: {str(e)}", file=sys.stderr)
        sys.exit(1)

def parse_snyk_vulnerabilities(snyk_data: Dict) -> Dict[str, Set[str]]:
    """Parse Snyk 2026 scan results into a dict of severity -> vulnerability IDs."""
    vulns_by_severity = {
        "critical": set(),
        "high": set(),
        "medium": set(),
        "low": set()
    }
    try:
        # Snyk 2026 output structure: { "vulnerabilities": [ ... ] }
        for vuln in snyk_data.get("vulnerabilities", []):
            severity = SNYK_SEVERITY_MAP.get(vuln.get("severity", "").lower())
            if not severity:
                continue
            # Use Snyk vulnerability ID as unique identifier
            vuln_id = vuln.get("id")
            if vuln_id:
                vulns_by_severity[severity].add(vuln_id)
        return vulns_by_severity
    except Exception as e:
        print("::error::Failed to parse Snyk results: {str(e)}", file=sys.stderr)
        sys.exit(1)

def parse_trivy_vulnerabilities(trivy_data: Dict) -> Dict[str, Set[str]]:
    """Parse Trivy 0.50 scan results into a dict of severity -> vulnerability IDs."""
    vulns_by_severity = {
        "critical": set(),
        "high": set(),
        "medium": set(),
        "low": set()
    }
    try:
        # Trivy 0.50 output structure: { "Results": [ { "Vulnerabilities": [ ... ] } ] }
        for result in trivy_data.get("Results", []):
            for vuln in result.get("Vulnerabilities", []):
                severity = TRIVY_SEVERITY_MAP.get(vuln.get("Severity", "").upper())
                if not severity:
                    continue
                # Use Trivy vulnerability ID (VendorVulnID) as unique identifier
                vuln_id = vuln.get("VulnerabilityID")
                if vuln_id:
                    vulns_by_severity[severity].add(vuln_id)
        return vulns_by_severity
    except Exception as e:
        print("::error::Failed to parse Trivy results: {str(e)}", file=sys.stderr)
        sys.exit(1)

def calculate_match_percentage(snyk_vulns: Set[str], trivy_vulns: Set[str]) -> float:
    """Calculate percentage of Snyk vulnerabilities detected by Trivy."""
    if not snyk_vulns:
        return 100.0
    intersection = snyk_vulns.intersection(trivy_vulns)
    return (len(intersection) / len(snyk_vulns)) * 100

def main():
    parser = argparse.ArgumentParser(description="Compare Snyk and Trivy container scan results")
    parser.add_argument("--snyk-file", required=True, help="Path to Snyk 2026 JSON scan results")
    parser.add_argument("--trivy-file", required=True, help="Path to Trivy 0.50 JSON scan results")
    parser.add_argument("--output", required=True, help="Path to output comparison report JSON")
    args = parser.parse_args()

    # Load scan results
    snyk_data = load_json_file(args.snyk_file)
    trivy_data = load_json_file(args.trivy_file)

    # Parse vulnerabilities by severity
    snyk_vulns = parse_snyk_vulnerabilities(snyk_data)
    trivy_vulns = parse_trivy_vulnerabilities(trivy_data)

    # Calculate match percentages for each severity
    report = {
        "critical_match_percentage": round(calculate_match_percentage(snyk_vulns["critical"], trivy_vulns["critical"]), 2),
        "high_match_percentage": round(calculate_match_percentage(snyk_vulns["high"], trivy_vulns["high"]), 2),
        "medium_match_percentage": round(calculate_match_percentage(snyk_vulns["medium"], trivy_vulns["medium"]), 2),
        "snyk_critical_count": len(snyk_vulns["critical"]),
        "trivy_critical_count": len(trivy_vulns["critical"]),
        "snyk_high_count": len(snyk_vulns["high"]),
        "trivy_high_count": len(trivy_vulns["high"])
    }

    # Write report to output file
    try:
        with open(args.output, 'w') as f:
            json.dump(report, f, indent=2)
        print(f"Comparison report written to {args.output}")
        print(f"Critical match: {report['critical_match_percentage']}%")
        print(f"High match: {report['high_match_percentage']}%")
    except Exception as e:
        print("::error::Failed to write output report: {str(e)}", file=sys.stderr)
        sys.exit(1)

if __name__ == "__main__":
    main()

// cmd/trivy-cache-manager/main.go
// Manages Trivy 0.50 vulnerability database cache
// Automates updates, validates checksums, and cleans stale cache entries
// Reduces CI/CD scan time by pre-warming cache on self-hosted runners

package main

import (
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
    "path/filepath"
    "time"

    "github.com/spf13/cobra"
)

const (
    trivyDBURL        = "https://github.com/aquasecurity/trivy-db/releases/latest/download/trivy.db"
    trivyDBChecksumURL = "https://github.com/aquasecurity/trivy-db/releases/latest/download/trivy.db.sha256"
    defaultCacheDir   = "~/.cache/trivy"
    cacheValidity     = 24 * time.Hour // Cache is valid for 24 hours
)

var (
    cacheDir    string
    forceUpdate bool
)

func init() {
    rootCmd.Flags().StringVar(&cacheDir, "cache-dir", defaultCacheDir, "Trivy cache directory")
    rootCmd.Flags().BoolVar(&forceUpdate, "force", false, "Force update even if cache is valid")
}

var rootCmd = &cobra.Command{
    Use:   "trivy-cache-manager",
    Short: "Manage Trivy vulnerability database cache",
    Long:  `Automates Trivy DB updates, checksum validation, and stale cache cleanup for CI/CD pipelines.`,
    Run: func(cmd *cobra.Command, args []string) {
        if err := run(); err != nil {
            fmt.Fprintf(os.Stderr, "Error: %v\n", err)
            os.Exit(1)
        }
    },
}

func run() error {
    // Expand ~ in cache dir
    expandedCacheDir, err := expandHome(cacheDir)
    if err != nil {
        return fmt.Errorf("failed to expand cache dir: %w", err)
    }
    cacheDir = expandedCacheDir

    // Check if cache is valid and update is not forced
    if !forceUpdate {
        valid, err := isCacheValid(cacheDir)
        if err != nil {
            return fmt.Errorf("failed to check cache validity: %w", err)
        }
        if valid {
            fmt.Println("Trivy DB cache is up to date, skipping update")
            return nil
        }
    }

    // Download latest checksum
    fmt.Println("Downloading Trivy DB checksum...")
    checksum, err := downloadChecksum(trivyDBChecksumURL)
    if err != nil {
        return fmt.Errorf("failed to download checksum: %w", err)
    }

    // Download Trivy DB
    fmt.Println("Downloading Trivy DB...")
    dbPath := filepath.Join(cacheDir, "trivy.db")
    if err := downloadFile(trivyDBURL, dbPath); err != nil {
        return fmt.Errorf("failed to download Trivy DB: %w", err)
    }

    // Verify checksum
    fmt.Println("Verifying Trivy DB checksum...")
    if err := verifyChecksum(dbPath, checksum); err != nil {
        // Clean up invalid DB file
        os.Remove(dbPath)
        return fmt.Errorf("checksum verification failed: %w", err)
    }

    // Update cache metadata
    metadata := map[string]interface{}{
        "last_updated": time.Now().UTC().Format(time.RFC3339),
        "checksum":     checksum,
    }
    metadataPath := filepath.Join(cacheDir, "cache-metadata.json")
    if err := writeMetadata(metadataPath, metadata); err != nil {
        return fmt.Errorf("failed to write cache metadata: %w", err)
    }

    // Clean stale cache entries (older than 7 days)
    fmt.Println("Cleaning stale cache entries...")
    if err := cleanStaleCache(cacheDir); err != nil {
        return fmt.Errorf("failed to clean stale cache: %w", err)
    }

    fmt.Println("Trivy DB cache update completed successfully")
    return nil
}

func expandHome(path string) (string, error) {
    if len(path) == 0 || path[0] != '~' {
        return path, nil
    }
    home, err := os.UserHomeDir()
    if err != nil {
        return "", err
    }
    return filepath.Join(home, path[1:]), nil
}

func isCacheValid(cacheDir string) (bool, error) {
    metadataPath := filepath.Join(cacheDir, "cache-metadata.json")
    if _, err := os.Stat(metadataPath); os.IsNotExist(err) {
        return false, nil
    }
    data, err := os.ReadFile(metadataPath)
    if err != nil {
        return false, err
    }
    var metadata map[string]interface{}
    if err := json.Unmarshal(data, &metadata); err != nil {
        return false, err
    }
    lastUpdatedStr, ok := metadata["last_updated"].(string)
    if !ok {
        return false, nil
    }
    lastUpdated, err := time.Parse(time.RFC3339, lastUpdatedStr)
    if err != nil {
        return false, nil
    }
    // Check if cache is within validity period
    return time.Since(lastUpdated) < cacheValidity, nil
}

func downloadChecksum(url string) (string, error) {
    resp, err := http.Get(url)
    if err != nil {
        return "", err
    }
    defer resp.Body.Close()
    if resp.StatusCode != http.StatusOK {
        return "", fmt.Errorf("checksum download failed with status %d", resp.StatusCode)
    }
    data, err := io.ReadAll(resp.Body)
    if err != nil {
        return "", err
    }
    // Checksum file is in format "checksum  trivy.db"
    return string(data[:64]), nil // SHA256 is 64 hex chars
}

func downloadFile(url, path string) error {
    // Create cache directory if it doesn't exist
    if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
        return err
    }
    resp, err := http.Get(url)
    if err != nil {
        return err
    }
    defer resp.Body.Close()
    if resp.StatusCode != http.StatusOK {
        return fmt.Errorf("DB download failed with status %d", resp.StatusCode)
    }
    out, err := os.Create(path)
    if err != nil {
        return err
    }
    defer out.Close()
    _, err = io.Copy(out, resp.Body)
    return err
}

func verifyChecksum(path, expectedChecksum string) error {
    file, err := os.Open(path)
    if err != nil {
        return err
    }
    defer file.Close()
    hash := sha256.New()
    if _, err := io.Copy(hash, file); err != nil {
        return err
    }
    actualChecksum := hex.EncodeToString(hash.Sum(nil))
    if actualChecksum != expectedChecksum {
        return fmt.Errorf("checksum mismatch: expected %s, got %s", expectedChecksum, actualChecksum)
    }
    return nil
}

func writeMetadata(path string, metadata map[string]interface{}) error {
    data, err := json.MarshalIndent(metadata, "", "  ")
    if err != nil {
        return err
    }
    return os.WriteFile(path, data, 0644)
}

func cleanStaleCache(cacheDir string) error {
    entries, err := os.ReadDir(cacheDir)
    if err != nil {
        return err
    }
    cutoff := time.Now().Add(-7 * 24 * time.Hour)
    for _, entry := range entries {
        if entry.IsDir() {
            continue
        }
        info, err := entry.Info()
        if err != nil {
            continue
        }
        if info.ModTime().Before(cutoff) {
            fmt.Printf("Removing stale cache entry: %s\n", entry.Name())
            os.Remove(filepath.Join(cacheDir, entry.Name()))
        }
    }
    return nil
}

func main() {
    if err := rootCmd.Execute(); err != nil {
        fmt.Fprintf(os.Stderr, "Error: %v\n", err)
        os.Exit(1)
    }
}

- name: Cache Trivy DB
  uses: actions/cache@v4
  with:
    path: ~/.cache/trivy
    key: trivy-db-${{ hashFiles('**/trivy-cache-manager') }}
    restore-keys: trivy-db-

import requests

def get_snyk_id(cve_id: str) -> list[str]:
    # Query Snyk public API for CVE mapping
    resp = requests.get(f"https://api.snyk.io/v1/vulnerabilities/cve/{cve_id}")
    resp.raise_for_status()
    return [vuln["id"] for vuln in resp.json().get("vulnerabilities", [])]

# .trivyignore
# Ignore low-severity vulnerabilities in Alpine base image
vulnerability:LOW

# Ignore specific CVE in libssl that is not exploitable in our runtime
CVE-2024-5678

# Ignore all vulnerabilities in test dependencies
path:**/node_modules/**/*test*