Supercharge secrets management Snyk using Trivy: A Comprehensive Guide

package main

import (
    "encoding/json"
    "flag"
    "fmt"
    "io/ioutil"
    "log"
    "os"
    "path/filepath"
    "strings"
    "time"
)

// TrivySecret represents a single secrets finding from Trivy's JSON output
type TrivySecret struct {
    Target          string `json:"Target"`
    Class           string `json:"Class"`
    Type            string `json:"Type"`
    Title           string `json:"Title"`
    Severity        string `json:"Severity"`
    Description     string `json:"Description"`
    FilePath        string `json:"FilePath"`
    LineNumber      int    `json:"LineNumber"`
    Match           string `json:"Match"`
    Layer           string `json:"Layer"`
    FixedVersion    string `json:"FixedVersion"`
    PublishedDate   string `json:"PublishedDate"`
    LastModifiedDate string `json:"LastModifiedDate"`
}

// TrivyReport is the top-level structure of Trivy's JSON output
type TrivyReport struct {
    SchemaVersion string        `json:"SchemaVersion"`
    ArtifactName  string        `json:"ArtifactName"`
    ArtifactType  string        `json:"ArtifactType"`
    Metadata      interface{}   `json:"Metadata"`
    Results       []TrivyResult `json:"Results"`
}

// TrivyResult contains findings for a single target in Trivy's output
type TrivyResult struct {
    Target string        `json:"Target"`
    Class  string        `json:"Class"`
    Secrets []TrivySecret `json:"Secrets"`
}

// SnykFinding maps to Snyk's vulnerability JSON schema for custom findings
type SnykFinding struct {
    ID               string                 `json:"id"`
    Title            string                 `json:"title"`
    Severity         string                 `json:"severity"`
    Description      string                 `json:"description"`
    Package          SnykPackage            `json:"package"`
    Exploit          interface{}            `json:"exploit"`
    References       []string               `json:"references"`
    CreatedAt        string                 `json:"createdAt"`
    ModifiedAt       string                 `json:"modifiedAt"`
    AdditionalInfo   map[string]interface{} `json:"additionalInfo"`
}

// SnykPackage represents the affected package in Snyk's schema (here, the container image layer)
type SnykPackage struct {
    Name    string `json:"name"`
    Version string `json:"version"`
}

// SnykReport is the top-level structure for Snyk-ingestible custom findings
type SnykReport struct {
    SchemaVersion string        `json:"schemaVersion"`
    Findings      []SnykFinding `json:"findings"`
}

func main() {
    // Parse command line flags
    inputPath := flag.String("input", "trivy-report.json", "Path to Trivy JSON secrets report")
    outputPath := flag.String("output", "snyk-custom-findings.json", "Path to write Snyk-compatible JSON report")
    snykProjectID := flag.String("project-id", "", "Snyk project ID to associate findings with (optional)")
    flag.Parse()

    // Validate input file exists
    if _, err := os.Stat(*inputPath); os.IsNotExist(err) {
        log.Fatalf("Input file %s does not exist: %v", *inputPath, err)
    }

    // Read Trivy report
    trivyData, err := ioutil.ReadFile(*inputPath)
    if err != nil {
        log.Fatalf("Failed to read Trivy report: %v", err)
    }

    // Unmarshal Trivy report
    var trivyReport TrivyReport
    if err := json.Unmarshal(trivyData, &trivyReport); err != nil {
        log.Fatalf("Failed to unmarshal Trivy report: %v", err)
    }

    // Initialize Snyk report
    snykReport := SnykReport{
        SchemaVersion: "1.0.0",
        Findings:      []SnykFinding{},
    }

    // Convert each Trivy secret to Snyk format
    for _, result := range trivyReport.Results {
        // Skip non-secret results
        if result.Class != "secret" {
            continue
        }
        for _, secret := range result.Secrets {
            // Map Trivy severity to Snyk severity (Trivy uses CRITICAL/HIGH/MEDIUM/LOW, Snyk same)
            severity := strings.ToLower(secret.Severity)
            if severity == "critical" {
                severity = "high" // Snyk uses high instead of critical for custom findings
            }

            // Create Snyk finding
            finding := SnykFinding{
                ID:     fmt.Sprintf("trivy-secret-%s-%d", filepath.Base(secret.FilePath), secret.LineNumber),
                Title:  fmt.Sprintf("Leaked secret: %s", secret.Title),
                Severity: severity,
                Description: fmt.Sprintf("Trivy detected a leaked secret of type %s in %s at line %d. Match: %s", secret.Type, secret.FilePath, secret.LineNumber, secret.Match),
                Package: SnykPackage{
                    Name:    fmt.Sprintf("container-image:%s", trivyReport.ArtifactName),
                    Version: trivyReport.ArtifactName,
                },
                References: []string{
                    "https://github.com/aquasecurity/trivy",
                    fmt.Sprintf("file://%s#L%d", secret.FilePath, secret.LineNumber),
                },
                CreatedAt:  time.Now().UTC().Format(time.RFC3339),
                ModifiedAt: time.Now().UTC().Format(time.RFC3339),
                AdditionalInfo: map[string]interface{}{
                    "trivy-type":     secret.Type,
                    "trivy-match":    secret.Match,
                    "trivy-layer":    secret.Layer,
                    "file-path":      secret.FilePath,
                    "line-number":    secret.LineNumber,
                    "snyk-project-id": *snykProjectID,
                },
            }
            snykReport.Findings = append(snykReport.Findings, finding)
        }
    }

    // Marshal Snyk report to JSON
    snykData, err := json.MarshalIndent(snykReport, "", "  ")
    if err != nil {
        log.Fatalf("Failed to marshal Snyk report: %v", err)
    }

    // Write output file
    if err := ioutil.WriteFile(*outputPath, snykData, 0644); err != nil {
        log.Fatalf("Failed to write Snyk report: %v", err)
    }

    fmt.Printf("Successfully converted %d Trivy secrets to Snyk format. Output written to %s\n", len(snykReport.Findings), *outputPath)
}

# Build the binary
go build -o trivy-snyk-normalizer cmd/normalizer/main.go

# Run conversion
./trivy-snyk-normalizer --input trivy-report.json --output snyk-findings.json --project-id your-snyk-project-id

import argparse
import json
import logging
import os
import sys
from datetime import datetime
from typing import Dict, List, Any

import requests
from requests.exceptions import RequestException

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s"
)
logger = logging.getLogger(__name__)

# Snyk API base URL
SNYK_API_BASE = "https://api.snyk.io/v1"

class SnykIngestor:
    """Handles ingesting custom Trivy-converted findings into Snyk and triggering scans."""

    def __init__(self, org_id: str, api_token: str):
        self.org_id = org_id
        self.api_token = api_token
        self.headers = {
            "Authorization": f"token {api_token}",
            "Content-Type": "application/json"
        }

    def ingest_custom_findings(self, project_id: str, findings_path: str) -> bool:
        """Ingest converted Trivy findings into Snyk for a given project."""
        # Validate findings file exists
        if not os.path.exists(findings_path):
            logger.error(f"Findings file {findings_path} does not exist")
            return False

        # Read findings file
        try:
            with open(findings_path, "r") as f:
                findings_data = json.load(f)
        except json.JSONDecodeError as e:
            logger.error(f"Failed to parse findings JSON: {e}")
            return False
        except IOError as e:
            logger.error(f"Failed to read findings file: {e}")
            return False

        # Validate findings schema
        if "findings" not in findings_data or not isinstance(findings_data["findings"], list):
            logger.error("Invalid findings schema: missing 'findings' array")
            return False

        # Ingest findings via Snyk API
        ingest_url = f"{SNYK_API_BASE}/org/{self.org_id}/project/{project_id}/custom-findings"
        try:
            response = requests.post(
                ingest_url,
                headers=self.headers,
                json=findings_data,
                timeout=30
            )
            response.raise_for_status()
        except RequestException as e:
            logger.error(f"Failed to ingest findings: {e}")
            if hasattr(e, "response") and e.response is not None:
                logger.error(f"Snyk API response: {e.response.text}")
            return False

        logger.info(f"Successfully ingested {len(findings_data['findings'])} findings into Snyk project {project_id}")
        return True

    def trigger_snyk_test(self, project_id: str) -> Dict[str, Any]:
        """Trigger a Snyk test for the given project to update the dashboard."""
        test_url = f"{SNYK_API_BASE}/org/{self.org_id}/project/{project_id}/test"
        try:
            response = requests.post(
                test_url,
                headers=self.headers,
                timeout=30
            )
            response.raise_for_status()
        except RequestException as e:
            logger.error(f"Failed to trigger Snyk test: {e}")
            if hasattr(e, "response") and e.response is not None:
                logger.error(f"Snyk API response: {e.response.text}")
            return {"status": "failed", "error": str(e)}

        logger.info(f"Triggered Snyk test for project {project_id}")
        return response.json()

def main():
    parser = argparse.ArgumentParser(description="Ingest Trivy-converted secrets findings into Snyk")
    parser.add_argument("--org-id", required=True, help="Snyk organization ID")
    parser.add_argument("--api-token", required=True, help="Snyk API token (or set SNYK_API_TOKEN env var)")
    parser.add_argument("--project-id", required=True, help="Snyk project ID to ingest findings into")
    parser.add_argument("--findings-path", default="snyk-custom-findings.json", help="Path to converted Snyk findings JSON")
    parser.add_argument("--skip-test", action="store_true", help="Skip triggering a Snyk test after ingestion")
    args = parser.parse_args()

    # Get API token from env var if not provided
    api_token = args.api_token or os.getenv("SNYK_API_TOKEN")
    if not api_token:
        logger.error("Snyk API token not provided. Set --api-token or SNYK_API_TOKEN env var")
        sys.exit(1)

    ingestor = SnykIngestor(org_id=args.org_id, api_token=api_token)

    # Ingest findings
    success = ingestor.ingest_custom_findings(
        project_id=args.project_id,
        findings_path=args.findings_path
    )
    if not success:
        logger.error("Failed to ingest findings. Exiting.")
        sys.exit(1)

    # Trigger Snyk test if not skipped
    if not args.skip_test:
        test_result = ingestor.trigger_snyk_test(project_id=args.project_id)
        if test_result.get("status") == "failed":
            logger.warning("Snyk test triggered but returned failure")
        else:
            logger.info(f"Snyk test completed. Findings count: {test_result.get('findingsCount', 'unknown')}")

if __name__ == "__main__":
    main()

# Install Python dependencies
pip install -r cmd/ingestor/requirements.txt

# Run ingestor
export SNYK_API_TOKEN="your-snyk-api-token"
python cmd/ingestor/ingest.py --org-id your-org-id --project-id your-project-id --findings-path snyk-findings.json

const fs = require('fs/promises');
const path = require('path');
const https = require('https');
const { URL } = require('url');

/**
 * Generates a combined markdown report from Snyk and Trivy secrets findings.
 * @param {string} snykFindingsPath - Path to Snyk custom findings JSON
 * @param {string} trivyReportPath - Path to original Trivy JSON report
 * @param {string} outputPath - Path to write markdown report
 */
async function generateReport(snykFindingsPath, trivyReportPath, outputPath) {
    try {
        // Read and parse Snyk findings
        const snykData = JSON.parse(await fs.readFile(snykFindingsPath, 'utf8'));
        // Read and parse Trivy report
        const trivyData = JSON.parse(await fs.readFile(trivyReportPath, 'utf8'));

        // Extract Trivy secrets
        const trivySecrets = [];
        for (const result of trivyData.Results || []) {
            if (result.Class === 'secret') {
                trivySecrets.push(...(result.Secrets || []));
            }
        }

        // Extract Snyk findings
        const snykFindings = snykData.findings || [];

        // Generate markdown content
        const reportLines = [
            '# Combined Secrets Scan Report',
            `Generated: ${new Date().toISOString()}`,
            '',
            '## Summary',
            `- Total Trivy secrets detected: ${trivySecrets.length}`,
            `- Total Snyk findings ingested: ${snykFindings.length}`,
            `- High severity findings: ${snykFindings.filter(f => f.severity === 'high').length}`,
            `- Medium severity findings: ${snykFindings.filter(f => f.severity === 'medium').length}`,
            `- Low severity findings: ${snykFindings.filter(f => f.severity === 'low').length}`,
            '',
            '## High Severity Findings (Snyk)',
        ];

        // Add high severity findings
        const highFindings = snykFindings.filter(f => f.severity === 'high');
        if (highFindings.length === 0) {
            reportLines.push('No high severity findings.');
        } else {
            highFindings.forEach((finding, idx) => {
                reportLines.push(`### ${idx + 1}. ${finding.title}`);
                reportLines.push(`- **ID**: ${finding.id}`);
                reportLines.push(`- **Severity**: ${finding.severity}`);
                reportLines.push(`- **Description**: ${finding.description}`);
                reportLines.push(`- **File Path**: ${finding.additionalInfo?.['file-path'] || 'Unknown'}`);
                reportLines.push(`- **Line Number**: ${finding.additionalInfo?.['line-number'] || 'Unknown'}`);
                reportLines.push(`- **Secret Type**: ${finding.additionalInfo?.['trivy-type'] || 'Unknown'}`);
                reportLines.push('');
            });
        }

        // Add Trivy raw secrets section
        reportLines.push('', '## Raw Trivy Secrets (All Severities)');
        if (trivySecrets.length === 0) {
            reportLines.push('No secrets detected by Trivy.');
        } else {
            trivySecrets.forEach((secret, idx) => {
                reportLines.push(`### ${idx + 1}. ${secret.Title || 'Unknown Secret'}`);
                reportLines.push(`- **Type**: ${secret.Type}`);
                reportLines.push(`- **Severity**: ${secret.Severity}`);
                reportLines.push(`- **File**: ${secret.FilePath}:${secret.LineNumber}`);
                reportLines.push(`- **Match**: ${secret.Match}`);
                reportLines.push('');
            });
        }

        // Write report to file
        await fs.writeFile(outputPath, reportLines.join('\n'), 'utf8');
        console.log(`Successfully generated report at ${outputPath}`);
    } catch (error) {
        console.error('Failed to generate report:', error.message);
        process.exit(1);
    }
}

// CLI argument parsing
async function main() {
    const args = process.argv.slice(2);
    if (args.length < 3) {
        console.error('Usage: node generate-report.js   ');
        process.exit(1);
    }

    const [snykPath, trivyPath, outputPath] = args;

    // Validate input files exist
    for (const filePath of [snykPath, trivyPath]) {
        try {
            await fs.access(filePath, fs.constants.F_OK);
        } catch (error) {
            console.error(`Input file ${filePath} does not exist:`, error.message);
            process.exit(1);
        }
    }

    await generateReport(snykPath, trivyPath, outputPath);
}

main();

node cmd/report/generate-report.js snyk-findings.json trivy-report.json report.md

name: Secrets Scan with Trivy + Snyk
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Cache Trivy DB
        uses: actions/cache@v4
        with:
          path: ~/.trivy/cache
          key: ${{ runner.os }}-trivy-${{ hashFiles('**/.trivyignore') }}
          restore-keys: ${{ runner.os }}-trivy-

      - name: Install Trivy
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.50.1
          trivy --version

      - name: Install Snyk CLI
        run: |
          npm install -g snyk@1.1310
          snyk --version

      - name: Authenticate Snyk
        run: snyk auth ${{ secrets.SNYK_API_TOKEN }}
        env:
          SNYK_API_TOKEN: ${{ secrets.SNYK_API_TOKEN }}

      - name: Build container image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy secrets scan
        run: |
          trivy image --scanners secret --format json --output trivy-report.json myapp:${{ github.sha }}
          # Fail if Trivy detects high/critical secrets (optional)
          trivy image --scanners secret --severity HIGH,CRITICAL --exit-code 1 myapp:${{ github.sha }}

      - name: Convert Trivy findings to Snyk format
        run: |
          go build -o trivy-snyk-normalizer cmd/normalizer/main.go
          ./trivy-snyk-normalizer --input trivy-report.json --output snyk-findings.json --project-id ${{ secrets.SNYK_PROJECT_ID }}

      - name: Ingest findings into Snyk
        run: |
          pip install -r cmd/ingestor/requirements.txt
          python cmd/ingestor/ingest.py \
            --org-id ${{ secrets.SNYK_ORG_ID }} \
            --project-id ${{ secrets.SNYK_PROJECT_ID }} \
            --findings-path snyk-findings.json
        env:
          SNYK_API_TOKEN: ${{ secrets.SNYK_API_TOKEN }}

      - name: Generate markdown report
        run: |
          node cmd/report/generate-report.js snyk-findings.json trivy-report.json report.md

      - name: Comment PR with report
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const report = fs.readFileSync('report.md', 'utf8');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: report
            });

      - name: Upload reports as artifacts
        uses: actions/upload-artifact@v4
        with:
          name: secrets-scan-reports
          path: |
            trivy-report.json
            snyk-findings.json
            report.md

- name: Cache Trivy DB
  uses: actions/cache@v4
  with:
    path: ~/.trivy/cache
    key: ${{ runner.os }}-trivy-${{ hashFiles('**/trivy.yaml') }}
    restore-keys: ${{ runner.os }}-trivy-

// Map Trivy severity to Snyk severity
severity := strings.ToLower(secret.Severity)
if severity == "critical" {
    severity = "high" // Snyk uses high instead of critical for custom findings
}

# Ignore test secrets
test/**/*
examples/**/*.md

# Ignore mock AWS keys
**/mock-*aws*.json

# Ignore Stripe test keys
*stripe_test_*

snyk-trivy-secrets/
├── cmd/
│   ├── normalizer/       # Go normalizer script (Code Example 1)
│   │   └── main.go
│   ├── ingestor/         # Python Snyk ingestor (Code Example 2)
│   │   └── ingest.py
│   └── report/           # Node.js report generator (Code Example 3)
│       └── generate-report.js
├── .github/
│   └── workflows/        # GitHub Actions CI/CD workflow
│       └── secrets-scan.yml
├── .trivyignore          # Example Trivy ignore rules
├── go.mod                # Go module dependencies
├── requirements.txt      # Python dependencies
├── package.json          # Node.js dependencies
└── README.md             # Setup and usage instructions