Replace Snyk scans with Trivy

.github/trivy-lock.init.gradle

@@ -0,0 +1,23 @@
+// Writes a gradle.lockfile per project with only the classpath that ships, so Trivy scans what ships.
+// It mirrors the old Snyk gate's --configuration-matching="^runtimeClasspath$".
+// Usage: ./gradlew -I trivy-lock.init.gradle trivyLock --write-locks
+// Android modules have no runtimeClasspath; pass -PtrivyConfigurations=releaseRuntimeClasspath (comma-separated).
+allprojects {
+    def lockedNames = (findProperty('trivyConfigurations') ?: 'runtimeClasspath').toString().split(',')*.trim()
+    configurations.matching { it.name in lockedNames }.configureEach {
+        resolutionStrategy.activateDependencyLocking()
+    }
+    tasks.register('trivyLock') {
+        notCompatibleWithConfigurationCache('resolves configurations at execution time')
+        doLast {
+            if (!gradle.startParameter.writeDependencyLocks) {
+                throw new GradleException('Run trivyLock with --write-locks')
+            }
+            // Resolve only the dependency graph, which is all that locking needs. Resolving files (resolve())
+            // fails in multi-module Android builds, where project dependencies offer several artifact variants.
+            project.configurations.matching { it.name in lockedNames && it.canBeResolved }.each {
+                it.incoming.resolutionResult.allComponents
+            }
+        }
+    }
+}

.github/workflows/scheduled-snyk-docker.yaml → .github/workflows/scheduled-trivy-docker.yaml

@@ -1,4 +1,4 @@
-name: Snyk scheduled Docker base image scan
+name: Trivy scheduled Docker base image scan
 
 on:
   schedule:
@@ -45,32 +45,32 @@ jobs:
       security-events: write
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Lowercase image name
         run: |
           echo "DOCKER_IMAGE=${REGISTRY}/${REPOSITORY,,}/${{ matrix.image.name }}" >>${GITHUB_ENV}
 
-      - name: Run Snyk to check for vulnerabilities
-        continue-on-error: true # To make sure that SARIF upload gets called
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      - uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
         with:
-          image: ${{ env.DOCKER_IMAGE }}
-          args: >-
-            --file=${{ matrix.image.build_file }}
-            --fail-on=upgradable
-            --severity-threshold=high
-            --policy-path=.snyk
-            --exclude-app-vulns
-            --org=radar-base
-            --sarif-file-output=snyk.sarif
+          version: v0.74.0
+          cache: true
 
-      # Detected vulnerabilities will appear on Github in Security->Code_scanning_alerts tab
+      # '--pkg-types os' only tests the base image, like Snyk's --exclude-app-vulns.
+      # Code base vulnerabilities are tested in scheduled-trivy.yaml.
+      - name: Run Trivy to check for vulnerabilities
+        run: >-
+          trivy image
+          --scanners vuln
+          --pkg-types os
+          --ignorefile .trivyignore.yaml
+          --format sarif
+          --output trivy.sarif
+          "${DOCKER_IMAGE}"
+
+      # Detected vulnerabilities will appear on GitHub in Security -> Code scanning alerts
       - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
-          sarif_file: snyk.sarif
-          category: ${{ matrix.image.name }}
-
+          sarif_file: trivy.sarif
+          category: trivy-image-${{ matrix.image.name }}

.github/workflows/scheduled-trivy.yaml

@@ -0,0 +1,48 @@
+name: Trivy scheduled code base scan
+
+on:
+  schedule:
+    - cron: '0 2 * * 1'
+  workflow_dispatch:
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+
+      - name: Lock the runtime classpath for Trivy
+        run: ./gradlew -I .github/trivy-lock.init.gradle trivyLock --write-locks
+
+      - uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
+        with:
+          version: v0.74.0
+          cache: true
+
+      # All severities: Code scanning shows the severity, and low-rated findings often hide under-rated issues.
+      - name: Run Trivy to check for vulnerabilities
+        run: >-
+          trivy fs
+          --scanners vuln
+          --ignorefile .trivyignore.yaml
+          --format sarif
+          --output trivy.sarif
+          .
+
+      # Detected vulnerabilities will appear on GitHub in Security -> Code scanning alerts
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          sarif_file: trivy.sarif
+          category: trivy-dependencies

.github/workflows/trivy.yaml

@@ -0,0 +1,50 @@
+name: Trivy dependency scan
+
+on:
+  pull_request:
+    branches:
+      - master
+      - dev
+      - release-*
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+
+      # Trivy only sees Gradle dependencies through lockfiles. This locks just the shipped classpath.
+      - name: Lock the runtime classpath for Trivy
+        run: ./gradlew -I .github/trivy-lock.init.gradle trivyLock --write-locks
+
+      - uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
+        with:
+          version: v0.74.0
+          cache: true
+
+      # Every severity, also unfixed, so MEDIUM findings on shipped packages stay visible.
+      - name: List all findings
+        run: |
+          {
+            echo '### Trivy: all findings'
+            echo '```'
+            trivy fs --quiet --scanners vuln --ignorefile .trivyignore.yaml --format table .
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Fail on fixable HIGH/CRITICAL findings
+        run: >-
+          trivy fs
+          --scanners vuln
+          --severity HIGH,CRITICAL
+          --ignore-unfixed
+          --ignorefile .trivyignore.yaml
+          --exit-code 1
+          .

.trivyignore.yaml

@@ -0,0 +1,36 @@
+# Trivy ignore file (https://trivy.dev/latest/docs/configuration/filtering/#trivyignoreyaml).
+# Every entry needs a reason and an expiry, for example:
+#
+#   vulnerabilities:
+#     - id: CVE-2024-12345
+#       statement: Not exploitable, because ...
+#       expired_at: 2027-01-01
+vulnerabilities:
+  - id: CVE-2023-37920
+    statement: >-
+      certifi 2018.10.15 (HIGH) in scripts/REDCAP-FITBIT-AUTH-AUTO/requirements.txt, a helper script that isn't part of the shipped image: fixed only in urllib3 2.x / current certifi, which need a newer requests (and Python 3).
+    expired_at: 2027-04-05
+  - id: CVE-2025-66418
+    statement: >-
+      urllib3 1.26.20 (HIGH) in scripts/REDCAP-FITBIT-AUTH-AUTO/requirements.txt, a helper script that isn't part of the shipped image: fixed only in urllib3 2.x / current certifi, which need a newer requests (and Python 3).
+    expired_at: 2027-04-05
+  - id: CVE-2025-66471
+    statement: >-
+      urllib3 1.26.20 (HIGH) in scripts/REDCAP-FITBIT-AUTH-AUTO/requirements.txt, a helper script that isn't part of the shipped image: fixed only in urllib3 2.x / current certifi, which need a newer requests (and Python 3).
+    expired_at: 2027-04-05
+  - id: CVE-2026-21441
+    statement: >-
+      urllib3 1.26.20 (HIGH) in scripts/REDCAP-FITBIT-AUTH-AUTO/requirements.txt, a helper script that isn't part of the shipped image: fixed only in urllib3 2.x / current certifi, which need a newer requests (and Python 3).
+    expired_at: 2027-04-05
+  - id: CVE-2026-44431
+    statement: >-
+      urllib3 1.26.20 (HIGH) in scripts/REDCAP-FITBIT-AUTH-AUTO/requirements.txt, a helper script that isn't part of the shipped image: fixed only in urllib3 2.x / current certifi, which need a newer requests (and Python 3).
+    expired_at: 2027-04-05
+  - id: CVE-2026-97687
+    statement: >-
+      urllib3 1.26.20 (HIGH) in scripts/REDCAP-FITBIT-AUTH-AUTO/requirements.txt, a helper script that isn't part of the shipped image: fixed only in urllib3 2.x / current certifi, which need a newer requests (and Python 3).
+    expired_at: 2027-04-05
+  - id: CVE-2026-97689
+    statement: >-
+      urllib3 1.26.20 (HIGH) in scripts/REDCAP-FITBIT-AUTH-AUTO/requirements.txt, a helper script that isn't part of the shipped image: fixed only in urllib3 2.x / current certifi, which need a newer requests (and Python 3).
+    expired_at: 2027-04-05