Snyk Security Scan #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Snyk Security Scan | |
| ## requires SNYK_TOKEN and SNYK_ORG_ID secret | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| branches: main | |
| env: | |
| IMAGE_NAME: nodejs-goof-insights | |
| IMAGE_TAG: v1.1.9 | |
| PLATFORM: linux/amd64 | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }} | |
| jobs: | |
| build: | |
| name: Snyk Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 22 | |
| - uses: jongwooo/next-cache@v1 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Setup Snyk + snyk-filter # For information about the required commands https://docs.snyk.io/scm-ide-and-ci-cd-integrations/snyk-ci-cd-integrations | |
| run: | | |
| npm install snyk snyk-filter -g | |
| snyk auth $SNYK_TOKEN --auth-type=token | |
| - name: Snyk Open Source | |
| run: | | |
| snyk test --json | snyk-filter | |
| ## you can edit the .snyk-filter/snyk.yaml file in order to apply additional filters | |
| continue-on-error: true | |
| # snyk test --json --print-deps | snyk-delta --setPassIfNoBaseline false ## you can use snyk-delta to diff between previous snapshots for the same project | |
| # Use git submodules to centrally manage a .snyk policy file | |
| - name: Checkout .snyk file from private repo | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: iuriikogan-snyk/snyk-policy-master | |
| path: 'snyk' | |
| token: ${{ secrets.SNYK_REPO_TOKEN }} | |
| - name: Snyk Code | |
| run: | | |
| ## Hack to pull a centralized snyk policy to ignore directories e.g. /tests /mock | |
| ## cp ./snyk/.snyk ./.snyk | |
| ## echo $(cat ./snyk/snyk_sha) | sha256sum -c - | |
| snyk code test | |
| ### --policy-path='snyk' | |
| continue-on-error: true | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Snyk Container Test | |
| run: | | |
| ## If the imager isn't present on the Daemon snyk can pull it from an OCI Registry | |
| ## To do so you need either set env SNYK_REGISTRY_USERNAME & SNYK_REGISTRY_PASSWORD | |
| ## Otherwise you can pass credentials to the container test command | |
| ## flags: --registry_username --registry-password | |
| ## | |
| ## If it isn't available in the registry you can build the image in the pipeline | |
| ## if it's available on the Daemon snyk will use the local image | |
| ## | |
| ## docker build -f ./Dockerfile . \ | |
| ## --tag ${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} --platform=${{ env.PLATFORM }} | |
| ## snyk container test requires a Dockerfile in order to seperate base image vulns, user instructions | |
| ## (e.g. apk add), and Application Vulns (e.g. a package.json copied into a layer) | |
| ## it's recommended to exclude app vulns and only focus on the base image and user instructions | |
| ## platform flag is required for snyk to process the image | |
| ## | |
| snyk container test ${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} --file=Dockerfile \ | |
| --exclude-app-vulns --platform=${{ env.PLATFORM }} | |
| continue-on-error: true | |
| - name: Snyk IaC | |
| run: snyk iac test --org=${{ secrets.SNYK_ORG_ID }} | |
| continue-on-error: true |