We Reduced Critical Vulnerabilities by 80% Using Checkov 3.2, Trivy 0.50, and Snyk 1.130 in CI/CD

# Full CI/CD Security Pipeline Workflow for GitHub Actions
# Integrates Checkov 3.2, Trivy 0.50, Snyk 1.130
# Requires the following secrets set in GitHub repo settings:
# SNYK_TOKEN: Snyk API token from https://app.snyk.io/account
# AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY: For Checkov AWS checks (optional)
name: Security Scanning Pipeline
on:
  push:
    branches: [ main, release/* ]
  pull_request:
    branches: [ main ]

env:
  # Pin tool versions to avoid unexpected breaking changes
  CHECKOV_VERSION: 3.2.0
  TRIVY_VERSION: 0.50.0
  SNYK_VERSION: 1.130.0
  # Fail pipeline on critical/high vulnerabilities by default
  FAIL_ON_SEVERITY: critical

jobs:
  iac-scan:
    name: Checkov IaC Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Required for full git history if scanning git repos with Trivy

      - name: Install Checkov 3.2
        run: |
          python3 -m pip install --upgrade pip
          pip install checkov==${{ env.CHECKOV_VERSION }}
        continue-on-error: false # Fail immediately if Checkov install fails

      - name: Run Checkov Scan
        id: checkov-scan
        run: |
          # Scan all IaC files: Terraform, K8s manifests, CloudFormation
          # Checkov repo: https://github.com/bridgecrewio/checkov
          checkov -d . --output json --output-file checkov-results.json --soft-fail
          # Parse results to count critical findings
          CRITICAL_COUNT=$(jq '[.results.failed_checks[] | select(.severity == "CRITICAL")] | length' checkov-results.json)
          echo "critical_count=$CRITICAL_COUNT" >> $GITHUB_OUTPUT
          if [ "$CRITICAL_COUNT" -gt 0 ] && [ "${{ env.FAIL_ON_SEVERITY }}" = "critical" ]; then
            echo "::error::Found $CRITICAL_COUNT critical IaC vulnerabilities"
            exit 1
          fi
        continue-on-error: false

      - name: Upload Checkov Results
        if: always() # Upload even if scan fails
        uses: actions/upload-artifact@v4
        with:
          name: checkov-scan-results
          path: checkov-results.json
          retention-days: 30

  container-scan:
    name: Trivy Container Scan
    runs-on: ubuntu-latest
    needs: iac-scan # Run after IaC scan passes
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Build Container Image
        run: |
          docker build -t myapp:${{ github.sha }} .
        continue-on-error: false

      - name: Install Trivy 0.50
        run: |
          # Trivy repo: https://github.com/aquasecurity/trivy
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v${{ env.TRIVY_VERSION }}
          trivy --version # Verify install
        continue-on-error: false

      - name: Run Trivy Scan
        id: trivy-scan
        run: |
          # Scan built image for critical vulns, output JSON
          trivy image --severity CRITICAL --format json --output trivy-results.json myapp:${{ github.sha }}
          # Count critical vulns
          CRITICAL_COUNT=$(jq '[.Results[].Vulnerabilities[] | select(.Severity == "CRITICAL")] | length' trivy-results.json)
          echo "critical_count=$CRITICAL_COUNT" >> $GITHUB_OUTPUT
          if [ "$CRITICAL_COUNT" -gt 0 ] && [ "${{ env.FAIL_ON_SEVERITY }}" = "critical" ]; then
            echo "::error::Found $CRITICAL_COUNT critical container vulnerabilities"
            exit 1
          fi
        continue-on-error: false

      - name: Upload Trivy Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: trivy-scan-results
          path: trivy-results.json
          retention-days: 30

  dependency-scan:
    name: Snyk Dependency Scan
    runs-on: ubuntu-latest
    needs: container-scan
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Install Snyk 1.130
        run: |
          # Snyk CLI repo: https://github.com/snyk/snyk
          npm install -g snyk@${{ env.SNYK_VERSION }}
          snyk --version # Verify install
        continue-on-error: false

      - name: Authenticate Snyk
        run: |
          snyk auth ${{ secrets.SNYK_TOKEN }}
        continue-on-error: false

      - name: Run Snyk Scan
        id: snyk-scan
        run: |
          # Scan all dependencies, output JSON, fail on critical
          snyk test --severity-threshold=critical --json > snyk-results.json || true
          # Count critical vulns
          CRITICAL_COUNT=$(jq '[.vulnerabilities[] | select(.severity == "critical")] | length' snyk-results.json)
          echo "critical_count=$CRITICAL_COUNT" >> $GITHUB_OUTPUT
          if [ "$CRITICAL_COUNT" -gt 0 ] && [ "${{ env.FAIL_ON_SEVERITY }}" = "critical" ]; then
            echo "::error::Found $CRITICAL_COUNT critical dependency vulnerabilities"
            exit 1
          fi
        continue-on-error: false

      - name: Upload Snyk Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: snyk-scan-results
          path: snyk-results.json
          retention-days: 30

  aggregate-results:
    name: Aggregate Security Results
    runs-on: ubuntu-latest
    needs: [iac-scan, container-scan, dependency-scan]
    if: always() # Run even if previous jobs fail
    steps:
      - name: Download All Artifacts
        uses: actions/download-artifact@v4
        with:
          path: all-results

      - name: Generate Summary Report
        run: |
          echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "| Tool | Critical Vulns Found |" >> $GITHUB_STEP_SUMMARY
          echo "|------|-----------------------|" >> $GITHUB_STEP_SUMMARY
          echo "| Checkov 3.2 | ${{ needs.iac-scan.outputs.critical_count || 0 }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Trivy 0.50 | ${{ needs.container-scan.outputs.critical_count || 0 }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Snyk 1.130 | ${{ needs.dependency-scan.outputs.critical_count || 0 }} |" >> $GITHUB_STEP_SUMMARY

# Aggregator script for Checkov, Trivy, Snyk scan results
# Sends Slack alerts for critical vulnerabilities, exports CSV report
# Requires: pip install jq requests pandas
# Usage: python3 aggregate-results.py --checkov-results checkov.json --trivy-results trivy.json --snyk-results snyk.json --slack-webhook $SLACK_WEBHOOK

import argparse
import json
import csv
import os
import sys
from datetime import datetime
import requests
import pandas as pd

# Tool GitHub repos for attribution
CHECKOV_REPO = "https://github.com/bridgecrewio/checkov"
TRIVY_REPO = "https://github.com/aquasecurity/trivy"
SNYK_REPO = "https://github.com/snyk/snyk"

def parse_checkov_results(file_path):
    """Parse Checkov 3.2 JSON output, return list of critical vulns"""
    try:
        with open(file_path, 'r') as f:
            data = json.load(f)
        critical_vulns = []
        # Checkov 3.2 output structure: results.failed_checks
        for check in data.get('results', {}).get('failed_checks', []):
            if check.get('severity') == 'CRITICAL':
                critical_vulns.append({
                    'tool': 'Checkov 3.2',
                    'tool_repo': CHECKOV_REPO,
                    'id': check.get('check_id'),
                    'resource': check.get('resource'),
                    'description': check.get('description'),
                    'severity': check.get('severity'),
                    'link': check.get('guideline')
                })
        return critical_vulns
    except FileNotFoundError:
        print(f"Error: Checkov results file not found at {file_path}", file=sys.stderr)
        return []
    except json.JSONDecodeError:
        print(f"Error: Invalid JSON in Checkov results file {file_path}", file=sys.stderr)
        return []

def parse_trivy_results(file_path):
    """Parse Trivy 0.50 JSON output, return list of critical vulns"""
    try:
        with open(file_path, 'r') as f:
            data = json.load(f)
        critical_vulns = []
        # Trivy 0.50 output structure: Results[].Vulnerabilities[]
        for result in data.get('Results', []):
            for vuln in result.get('Vulnerabilities', []):
                if vuln.get('Severity') == 'CRITICAL':
                    critical_vulns.append({
                        'tool': 'Trivy 0.50',
                        'tool_repo': TRIVY_REPO,
                        'id': vuln.get('VulnerabilityID'),
                        'resource': result.get('Target'),
                        'description': vuln.get('Title'),
                        'severity': vuln.get('Severity'),
                        'link': vuln.get('PrimaryURL')
                    })
        return critical_vulns
    except FileNotFoundError:
        print(f"Error: Trivy results file not found at {file_path}", file=sys.stderr)
        return []
    except json.JSONDecodeError:
        print(f"Error: Invalid JSON in Trivy results file {file_path}", file=sys.stderr)
        return []

def parse_snyk_results(file_path):
    """Parse Snyk 1.130 JSON output, return list of critical vulns"""
    try:
        with open(file_path, 'r') as f:
            data = json.load(f)
        critical_vulns = []
        # Snyk 1.130 output structure: vulnerabilities[]
        for vuln in data.get('vulnerabilities', []):
            if vuln.get('severity') == 'critical':
                critical_vulns.append({
                    'tool': 'Snyk 1.130',
                    'tool_repo': SNYK_REPO,
                    'id': vuln.get('id'),
                    'resource': vuln.get('packageName'),
                    'description': vuln.get('title'),
                    'severity': vuln.get('severity'),
                    'link': vuln.get('url')
                })
        return critical_vulns
    except FileNotFoundError:
        print(f"Error: Snyk results file not found at {file_path}", file=sys.stderr)
        return []
    except json.JSONDecodeError:
        print(f"Error: Invalid JSON in Snyk results file {file_path}", file=sys.stderr)
        return []

def send_slack_alert(vulns, webhook_url):
    """Send Slack alert for critical vulnerabilities"""
    if not vulns:
        print("No critical vulns to alert on.")
        return
    if not webhook_url:
        print("Error: Slack webhook URL not provided", file=sys.stderr)
        return
    # Format Slack message
    blocks = [
        {
            "type": "header",
            "text": {
                "type": "plain_text",
                "text": f"🚨 {len(vulns)} Critical Security Vulnerabilities Found"
            }
        },
        {
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": f"Scan run at {datetime.utcnow().isoformat()} UTC"
            }
        }
    ]
    # Add up to 10 vulns to Slack message (avoid truncation)
    for vuln in vulns[:10]:
        blocks.append({
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": f"*Tool*: {vuln['tool']} ({vuln['tool_repo']})\n*ID*: {vuln['id']}\n*Resource*: {vuln['resource']}\n*Description*: {vuln['description']}\n*Link*: {vuln['link']}"
            }
        })
    if len(vulns) > 10:
        blocks.append({
            "type": "section",
            "text": {
                "type": "mrkdwn",
                "text": f"...and {len(vulns) - 10} more. See full report."
            }
        })
    # Send request
    try:
        response = requests.post(webhook_url, json={"blocks": blocks}, timeout=10)
        response.raise_for_status()
        print(f"Slack alert sent successfully: {response.status_code}")
    except requests.exceptions.RequestException as e:
        print(f"Error sending Slack alert: {e}", file=sys.stderr)

def export_csv(vulns, output_path):
    """Export aggregated vulns to CSV"""
    if not vulns:
        print("No vulns to export.")
        return
    try:
        df = pd.DataFrame(vulns)
        df.to_csv(output_path, index=False)
        print(f"CSV report exported to {output_path}")
    except Exception as e:
        print(f"Error exporting CSV: {e}", file=sys.stderr)

def main():
    parser = argparse.ArgumentParser(description='Aggregate security scan results from Checkov, Trivy, Snyk')
    parser.add_argument('--checkov-results', required=True, help='Path to Checkov JSON results')
    parser.add_argument('--trivy-results', required=True, help='Path to Trivy JSON results')
    parser.add_argument('--snyk-results', required=True, help='Path to Snyk JSON results')
    parser.add_argument('--slack-webhook', help='Slack webhook URL for alerts')
    parser.add_argument('--csv-output', default='aggregated-vulns.csv', help='Path to output CSV report')
    args = parser.parse_args()

    # Parse all results
    print("Parsing Checkov results...")
    checkov_vulns = parse_checkov_results(args.checkov_results)
    print(f"Found {len(checkov_vulns)} critical vulns in Checkov results")

    print("Parsing Trivy results...")
    trivy_vulns = parse_trivy_results(args.trivy_results)
    print(f"Found {len(trivy_vulns)} critical vulns in Trivy results")

    print("Parsing Snyk results...")
    snyk_vulns = parse_snyk_results(args.snyk_results)
    print(f"Found {len(snyk_vulns)} critical vulns in Snyk results")

    all_vulns = checkov_vulns + trivy_vulns + snyk_vulns
    print(f"Total critical vulns: {len(all_vulns)}")

    # Send alert and export report
    send_slack_alert(all_vulns, args.slack_webhook)
    export_csv(all_vulns, args.csv_output)

if __name__ == "__main__":
    main()

# Automated Remediation Script for Common Critical Vulnerabilities
# Fixes top 5 critical findings from Checkov, Trivy, Snyk
# Requires: terraform, kubectl, npm/pip/go (depending on project)
# Usage: ./remediate-vulns.sh --scan-results-dir ./all-results --apply

set -euo pipefail

# Tool versions (must match pipeline versions)
CHECKOV_VERSION="3.2.0"
TRIVY_VERSION="0.50.0"
SNYK_VERSION="1.130.0"

# GitHub repos for reference
CHECKOV_REPO="https://github.com/bridgecrewio/checkov"
TRIVY_REPO="https://github.com/aquasecurity/trivy"
SNYK_REPO="https://github.com/snyk/snyk"

# Parse arguments
APPLY_CHANGES=false
SCAN_RESULTS_DIR=""

while [[ $# -gt 0 ]]; do
  case $1 in
    --apply)
      APPLY_CHANGES=true
      shift
      ;;
    --scan-results-dir)
      SCAN_RESULTS_DIR="$2"
      shift 2
      ;;
    *)
      echo "Unknown argument: $1"
      exit 1
      ;;
  esac
done

if [ -z "$SCAN_RESULTS_DIR" ]; then
  echo "Error: --scan-results-dir is required"
  exit 1
fi

if [ ! -d "$SCAN_RESULTS_DIR" ]; then
  echo "Error: Scan results directory $SCAN_RESULTS_DIR does not exist"
  exit 1
fi

# Function to remediate Checkov IaC findings
remediate_checkov() {
  local checkov_results="$SCAN_RESULTS_DIR/checkov-scan-results/checkov-results.json"
  if [ ! -f "$checkov_results" ]; then
    echo "No Checkov results found, skipping IaC remediation"
    return
  fi
  echo "Remediating Checkov 3.2 critical findings..."
  # Parse critical failed checks
  local critical_checks=$(jq -r '.results.failed_checks[] | select(.severity == "CRITICAL") | .check_id' "$checkov_results")
  for check_id in $critical_checks; do
    case $check_id in
      "CKV_AWS_20") # S3 bucket has public read access
        echo "Remediating CKV_AWS_20: S3 bucket public read"
        # Find Terraform files with aws_s3_bucket
        local tf_files=$(grep -r -l "aws_s3_bucket" --include="*.tf" .)
        for tf_file in $tf_files; do
          echo "Updating $tf_file to disable public read"
          if [ "$APPLY_CHANGES" = true ]; then
            # Add acl = "private" and block public access
            sed -i '/resource "aws_s3_bucket"/a \  acl = "private"\n  block_public_access { block_public_acls = true; block_public_policy = true; ignore_public_acls = true; restrict_public_buckets = true }' "$tf_file"
            echo "Applied fix to $tf_file"
          else
            echo "Dry run: would apply fix to $tf_file"
          fi
        done
        ;;
      "CKV_K8S_40") # Container is running as root
        echo "Remediating CKV_K8S_40: Container running as root"
        local k8s_files=$(grep -r -l "kind: Pod\|kind: Deployment" --include="*.yaml" --include="*.yml" .)
        for k8s_file in $k8s_files; do
          echo "Updating $k8s_file to run as non-root"
          if [ "$APPLY_CHANGES" = true ]; then
            # Add security context to run as non-root
            sed -i '/containers:/a \        securityContext:\n          runAsNonRoot: true\n          runAsUser: 1000' "$k8s_file"
            echo "Applied fix to $k8s_file"
          else
            echo "Dry run: would apply fix to $k8s_file"
          fi
        done
        ;;
      *)
        echo "No automated remediation for Checkov check $check_id"
        ;;
    esac
  done
}

# Function to remediate Trivy container findings
remediate_trivy() {
  local trivy_results="$SCAN_RESULTS_DIR/trivy-scan-results/trivy-results.json"
  if [ ! -f "$trivy_results" ]; then
    echo "No Trivy results found, skipping container remediation"
    return
  fi
  echo "Remediating Trivy 0.50 critical findings..."
  # Parse critical vulns with fix available
  local fixable_vulns=$(jq -r '.Results[].Vulnerabilities[] | select(.Severity == "CRITICAL" and .FixedVersion != null) | .VulnerabilityID' "$trivy_results")
  for vuln_id in $fixable_vulns; do
    echo "Remediating Trivy vuln $vuln_id: update base image"
    # Find Dockerfiles
    local dockerfiles=$(find . -name "Dockerfile")
    for dockerfile in $dockerfiles; do
      # Check if base image is affected
      local base_image=$(grep "^FROM" "$dockerfile" | head -1 | awk '{print $2}')
      echo "Dockerfile $dockerfile uses base image $base_image"
      # Get fixed version from Trivy results
      local fixed_version=$(jq -r ".Results[].Vulnerabilities[] | select(.VulnerabilityID == \"$vuln_id\") | .FixedVersion" "$trivy_results" | head -1)
      if [ -n "$fixed_version" ]; then
        if [ "$APPLY_CHANGES" = true ]; then
          # Update Dockerfile base image to fixed version
          sed -i "s|^FROM $base_image|FROM $base_image:$fixed_version|" "$dockerfile"
          echo "Updated $dockerfile to use fixed base image version $fixed_version"
        else
          echo "Dry run: would update $dockerfile to $base_image:$fixed_version"
        fi
      fi
    done
  done
}

# Function to remediate Snyk dependency findings
remediate_snyk() {
  local snyk_results="$SCAN_RESULTS_DIR/snyk-scan-results/snyk-results.json"
  if [ ! -f "$snyk_results" ]; then
    echo "No Snyk results found, skipping dependency remediation"
    return
  fi
  echo "Remediating Snyk 1.130 critical findings..."
  # Parse critical vulns with fix available
  local fixable_vulns=$(jq -r '.vulnerabilities[] | select(.severity == "critical" and .fixedIn != null) | .id' "$snyk_results")
  for vuln_id in $fixable_vulns; do
    echo "Remediating Snyk vuln $vuln_id: update dependency"
    # Get package name and fixed version
    local package_name=$(jq -r ".vulnerabilities[] | select(.id == \"$vuln_id\") | .packageName" "$snyk_results")
    local fixed_version=$(jq -r ".vulnerabilities[] | select(.id == \"$vuln_id\") | .fixedIn" "$snyk_results")
    echo "Package $package_name has fix in version $fixed_version"
    # Check for package manager files
    if [ -f "package.json" ]; then
      echo "Updating npm package $package_name to $fixed_version"
      if [ "$APPLY_CHANGES" = true ]; then
        npm install $package_name@$fixed_version --save
        echo "Updated $package_name to $fixed_version"
      else
        echo "Dry run: would run npm install $package_name@$fixed_version"
      fi
    elif [ -f "requirements.txt" ]; then
      echo "Updating PyPI package $package_name to $fixed_version"
      if [ "$APPLY_CHANGES" = true ]; then
        pip install $package_name==$fixed_version
        echo "Updated $package_name to $fixed_version"
      else
        echo "Dry run: would run pip install $package_name==$fixed_version"
      fi
    else
      echo "No supported package manager found for $package_name"
    fi
  done
}

# Run all remediation functions
remediate_checkov
remediate_trivy
remediate_snyk

echo "Remediation complete. Apply changes: $APPLY_CHANGES"

# Pin versions in GitHub Actions env
env:
  CHECKOV_VERSION: 3.2.0
  TRIVY_VERSION: 0.50.0
  SNYK_VERSION: 1.130.0

# Soft fail examples for each tool
# Checkov
checkov -d . --soft-fail

# Trivy
trivy image --exit-code 0 myapp:latest

# Snyk
snyk test --json > results.json || true

# Run aggregation script after all scans
python3 aggregate-results.py \
  --checkov-results checkov.json \
  --trivy-results trivy.json \
  --snyk-results snyk.json \
  --slack-webhook $SLACK_WEBHOOK