Skip to content

Commit 8c5b1d9

Browse files
laforellaforel
committed
Troublesoot token validity
1 parent 0257ecf commit 8c5b1d9

File tree

1 file changed

+87
-12
lines changed

1 file changed

+87
-12
lines changed

‎.github/workflows/snyk-security.yml‎

Lines changed: 87 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ on:
2828
paths-ignore:
2929
- '**.md'
3030
- 'LICENSE'
31+
- '.github/**'
3132
schedule:
3233
# Run weekly scan on Mondays at 2 AM UTC
3334
- cron: '0 2 * * 1'
@@ -56,38 +57,95 @@ jobs:
5657
env:
5758
# This is where you will need to introduce the Snyk API token created with your Snyk account
5859
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
60+
61+
- name: Verify Snyk token is set
62+
run: |
63+
if [ -z "${{ secrets.SNYK_TOKEN }}" ]; then
64+
echo "ERROR: SNYK_TOKEN secret is not set in GitHub repository secrets!"
65+
echo "Please add your Snyk token at: Settings → Secrets → Actions → New repository secret"
66+
echo "Get your token from: https://app.snyk.io/account"
67+
exit 1
68+
fi
69+
echo "✓ SNYK_TOKEN secret is configured"
5970
6071
# Runs Snyk Code (SAST) analysis and uploads result into GitHub.
6172
# Note: Snyk Code may have limited support for C++, but we include it for completeness
6273
- name: Snyk Code test
74+
env:
75+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
6376
continue-on-error: true
64-
run: snyk code test --sarif > snyk-code.sarif || true
77+
run: |
78+
snyk code test --sarif > snyk-code.sarif 2>&1 || \
79+
echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema.json","runs":[{"tool":{"driver":{"name":"Snyk Code","version":"1.0.0"}},"results":[]}]}' > snyk-code.sarif || true
6580
6681
# Runs Snyk Open Source (SCA) analysis for vcpkg.json dependencies
67-
# This is the main scan for third-party component vulnerabilities
82+
# Try multiple approaches to scan vcpkg.json
6883
- name: Snyk Open Source test
84+
env:
85+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
6986
continue-on-error: true
7087
run: |
71-
# Try to scan vcpkg.json if supported, otherwise scan the project
88+
echo "Attempting to scan vcpkg.json..."
89+
90+
# Method 1: Try scanning vcpkg.json file directly (Snyk may auto-detect)
7291
if [ -f vcpkg.json ]; then
73-
snyk test --file=vcpkg.json --package-manager=vcpkg --sarif > snyk-open-source.sarif || \
74-
snyk test --sarif > snyk-open-source.sarif || true
75-
else
76-
snyk test --sarif > snyk-open-source.sarif || true
92+
echo "Method 1: Scanning vcpkg.json directly..."
93+
snyk test --file=vcpkg.json --sarif > snyk-open-source.sarif 2>&1 && echo "Success with vcpkg.json" && exit 0 || echo "Method 1 failed"
94+
95+
# Method 2: Try with --all-projects flag (may detect vcpkg.json)
96+
echo "Method 2: Trying --all-projects..."
97+
snyk test --all-projects --sarif > snyk-open-source.sarif 2>&1 && echo "Success with --all-projects" && exit 0 || echo "Method 2 failed"
98+
99+
# Method 3: Try scanning the project root (may auto-detect vcpkg.json)
100+
echo "Method 3: Scanning project root..."
101+
snyk test --sarif > snyk-open-source.sarif 2>&1 && echo "Success with project scan" && exit 0 || echo "Method 3 failed"
77102
fi
103+
104+
# Method 4: Fallback to unmanaged C++ scan
105+
echo "Method 4: Fallback to unmanaged C++ scan..."
106+
snyk test --unmanaged --sarif > snyk-open-source.sarif 2>&1 && echo "Success with unmanaged" && exit 0 || echo "Method 4 failed"
107+
108+
# If all methods fail, create empty valid SARIF
109+
echo "All scan methods failed, creating empty SARIF"
110+
echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema.json","runs":[{"tool":{"driver":{"name":"Snyk Open Source","version":"1.0.0"}},"results":[]}]}' > snyk-open-source.sarif
78111
79112
# Monitor dependencies in Snyk dashboard (for tracking over time)
80113
- name: Snyk Open Source monitor
114+
env:
115+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
81116
continue-on-error: true
82117
run: |
118+
echo "Monitoring dependencies in Snyk dashboard..."
119+
120+
# Try monitoring vcpkg.json if it exists
83121
if [ -f vcpkg.json ]; then
84-
snyk monitor --file=vcpkg.json --package-manager=vcpkg || \
85-
snyk monitor --all-projects || true
122+
echo "Attempting to monitor vcpkg.json..."
123+
snyk monitor --file=vcpkg.json || \
124+
snyk monitor --all-projects || \
125+
snyk monitor --unmanaged || true
86126
else
87-
snyk monitor --all-projects || true
127+
snyk monitor --all-projects || \
128+
snyk monitor --unmanaged || true
129+
fi
130+
131+
# Validate and upload Snyk Code results
132+
- name: Validate Snyk Code SARIF
133+
if: always()
134+
continue-on-error: true
135+
run: |
136+
if [ -f snyk-code.sarif ]; then
137+
# Check if file is valid JSON
138+
if jq empty snyk-code.sarif 2>/dev/null; then
139+
echo "SARIF file is valid JSON"
140+
else
141+
echo "SARIF file is invalid, creating empty valid SARIF"
142+
echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema.json","runs":[{"tool":{"driver":{"name":"Snyk Code","version":"1.0.0"}},"results":[]}]}' > snyk-code.sarif
143+
fi
144+
else
145+
echo "No SARIF file found, creating empty valid SARIF"
146+
echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema.json","runs":[{"tool":{"driver":{"name":"Snyk Code","version":"1.0.0"}},"results":[]}]}' > snyk-code.sarif
88147
fi
89148
90-
# Push the Snyk Code results into GitHub Code Scanning tab
91149
- name: Upload Snyk Code result to GitHub Code Scanning
92150
if: always()
93151
uses: github/codeql-action/upload-sarif@v3
@@ -96,7 +154,24 @@ jobs:
96154
wait-for-processing: true
97155
continue-on-error: true
98156

99-
# Push the Snyk Open Source results into GitHub Code Scanning tab
157+
# Validate and upload Snyk Open Source results
158+
- name: Validate Snyk Open Source SARIF
159+
if: always()
160+
continue-on-error: true
161+
run: |
162+
if [ -f snyk-open-source.sarif ]; then
163+
# Check if file is valid JSON
164+
if jq empty snyk-open-source.sarif 2>/dev/null; then
165+
echo "SARIF file is valid JSON"
166+
else
167+
echo "SARIF file is invalid, creating empty valid SARIF"
168+
echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema.json","runs":[{"tool":{"driver":{"name":"Snyk Open Source","version":"1.0.0"}},"results":[]}]}' > snyk-open-source.sarif
169+
fi
170+
else
171+
echo "No SARIF file found, creating empty valid SARIF"
172+
echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema.json","runs":[{"tool":{"driver":{"name":"Snyk Open Source","version":"1.0.0"}},"results":[]}]}' > snyk-open-source.sarif
173+
fi
174+
100175
- name: Upload Snyk Open Source result to GitHub Code Scanning
101176
if: always()
102177
uses: github/codeql-action/upload-sarif@v3

0 commit comments

Comments
 (0)