Merge pull request #24 from iuriikogan/iuriikogan-patch-4 #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Snyk Security Scans | ||
|
Check failure on line 1 in .github/workflows/snyk-security.yml
|
||
| ## requires SNYK_TOKEN and SNYK_ORG_ID secret | ||
| on: | ||
| workflow_dispatch: | ||
| pull_request: | ||
| branches: main | ||
| env: | ||
| IMAGE_NAME: ${{ env.IMAGE_NAME }} | ||
| IMAGE_TAG: ${{ env.IMAGE_TAG }} | ||
| PLATFORM: linux/amd64 | ||
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | ||
| SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }} | ||
| jobs: | ||
| build: | ||
| name: Snyk Scan | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout Repo | ||
| uses: actions/checkout@v4 | ||
| - name: Use Node.js 20.x | ||
| uses: actions/setup-node@v2 | ||
| with: | ||
| node-version: 22 | ||
| - name: Build project | ||
| run: npm install --legacy-peer-deps | ||
| - name: Setup Snyk + snyk-filter # For information about the required commands https://docs.snyk.io/scm-ide-and-ci-cd-integrations/snyk-ci-cd-integrations | ||
| run: | | ||
| npm install snyk snyk-filter -g | ||
| snyk auth $SNYK_TOKEN --auth-type=token | ||
| - name: Snyk Open Source | ||
| run: | | ||
| snyk test --json | snyk-filter | ||
| ## you can edit the .snyk-filter/snyk.yaml file in order to apply additional filters | ||
| continue-on-error: true | ||
| # snyk test --json --print-deps | snyk-delta --setPassIfNoBaseline false ## you can use snyk-delta to diff between previous snapshots for the same project | ||
| # Use git submodules to centrally manage a .snyk policy file | ||
| - name: Checkout .snyk file from private repo | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: iuriikogan-snyk/snyk-policy-master | ||
| path: 'snyk' | ||
| token: ${{ secrets.SNYK_REPO_TOKEN }} | ||
| - name: Snyk Code | ||
| run: | | ||
| cp ./snyk/.snyk ./.snyk | ||
| echo $(cat ./snyk/snyk_sha) | sha256sum -c - | ||
| snyk code test | ||
| # --policy-path='snyk' | ||
| continue-on-error: true | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| - name: Snyk Container Test | ||
| run: | | ||
| docker build -f ./Dockerfile . \ | ||
| --tag ${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} --platform=${{ env.PLATFORM }} | ||
| snyk container test ${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} --file=Dockerfile \ | ||
| --exclude-app-vulns --platform=${{ env.PLATFORM }} | ||
| # Rename your image, for uploading directly to your snyk org please use the command "snyk container monitor $container_name/$tag --org=$ORG_ID" | ||
| continue-on-error: true | ||
| - name: Snyk IaC | ||
| run: snyk iac test --org=${{ secrets.SNYK_ORG_ID }} | ||
| continue-on-error: true | ||
