Dependency Vulnerability Scan #204
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Scan | |
| # Issue #263 — Automated dependency vulnerability scanning | |
| # Runs Snyk on every PR and push to main/develop. | |
| # The job FAILS if any dependency has a known CVE at severity >= high, | |
| # blocking the merge until the vulnerability is resolved. | |
| on: | |
| push: | |
| branches: ["main", "develop", "feature/*"] | |
| pull_request: | |
| branches: ["main", "develop"] | |
| schedule: | |
| # Daily scan at 03:00 UTC to catch newly published CVEs | |
| - cron: "0 3 * * *" | |
| jobs: | |
| snyk-scan: | |
| name: Snyk — npm vulnerability scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: backend/package-lock.json | |
| - name: Install dependencies | |
| working-directory: ./backend | |
| run: npm ci | |
| # Snyk requires SNYK_TOKEN secret to be set in the repository settings. | |
| # Sign up at https://snyk.io and add the token as a repository secret. | |
| - name: Run Snyk to check for vulnerabilities | |
| uses: snyk/actions/node@v1.0.0 | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| args: > | |
| --file=backend/package.json | |
| --severity-threshold=high | |
| --fail-on=all | |
| # Upload Snyk results to GitHub Security tab (SARIF format) | |
| - name: Upload Snyk SARIF report | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: snyk.sarif | |
| continue-on-error: true # Don't fail if SARIF upload is unavailable | |
| npm-audit: | |
| name: npm audit — built-in vulnerability check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: backend/package-lock.json | |
| - name: Install dependencies | |
| working-directory: ./backend | |
| run: npm ci | |
| # npm audit as a fallback — fails on high/critical CVEs even without Snyk token | |
| - name: Run npm audit | |
| working-directory: ./backend | |
| run: npm audit --audit-level=high |