diff --git a/.github/workflows/snyk_sca_scan.yaml b/.github/workflows/snyk_sca_scan.yaml new file mode 100644 index 00000000..c2be0b8e --- /dev/null +++ b/.github/workflows/snyk_sca_scan.yaml @@ -0,0 +1,33 @@ +name: Snyk Software Composition Analysis Scan +# This git workflow leverages Snyk actions to perform a Software Composition +# Analysis scan on our Opensource libraries upon Pull Requests to Master & +# Develop branches. We use this as a control to prevent vulnerable packages +# from being introduced into the codebase. +on: + pull_request_target: + types: + - opened + branches: + - master + - develop +jobs: + Snyk_SCA_Scan: + runs-on: ubuntu-latest + strategy: + matrix: + node-version: [16.x] + steps: + - uses: actions/checkout@v2 + - name: Setting up Node + uses: actions/setup-node@v1 + with: + node-version: ${{ matrix.node-version }} + - name: Installing snyk-delta and dependencies + run: npm i -g snyk-delta + - uses: snyk/actions/setup@master + - name: Perform SCA Scan + continue-on-error: false + run: | + snyk test --all-projects --detection-depth=4 --exclude=docker,Dockerfile --severity-threshold=critical + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} diff --git a/.github/workflows/snyk_static_analysis_scan.yaml b/.github/workflows/snyk_static_analysis_scan.yaml new file mode 100644 index 00000000..b1f0e59d --- /dev/null +++ b/.github/workflows/snyk_static_analysis_scan.yaml @@ -0,0 +1,29 @@ +name: Snyk Static Analysis Scan +# This git workflow leverages Snyk actions to perform a Static Application +# Testing scan (SAST) on our first-party code upon Pull Requests to Master & +# Develop branches. We use this as a control to prevent vulnerabilities +# from being introduced into the codebase. +on: + pull_request_target: + types: + - opened + branches: + - master + - develop +jobs: + Snyk_SAST_Scan : + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + - uses: snyk/actions/setup@master + - name: Perform Static Analysis Test + continue-on-error: true + run: | + snyk code test --all-projects --detection-depth=4 --exclude=docker,Dockerfile --severity-threshold=high + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + # The Following Requires Advanced Security License + # - name: Upload results to Github Code Scanning + # uses: github/codeql-action/upload-sarif@v1 + # with: + # sarif_file: snyk_sarif