Update dependency hashicorp/terraform to v1.6.6 #150
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Snyk | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| branches: | |
| - master | |
| paths: | |
| - functions/** | |
| - src/** | |
| - test/** | |
| - terraform/** | |
| - '!src/content/**' | |
| env: | |
| cache-version: v2 | |
| jobs: | |
| snyk: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout source code | |
| uses: actions/checkout@v3 | |
| - name: Setup Node | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 18.12.1 | |
| registry-url: https://npm.pkg.github.com/ | |
| scope: '@tubone24' | |
| - name: Get yarn cache directory path | |
| id: yarn-cache-dir-path | |
| run: echo "dir=$(yarn cache dir)" >> "${GITHUB_OUTPUT}" | |
| - name: Cache | |
| uses: actions/cache/restore@v3 | |
| with: | |
| path: | | |
| ~/.cache | |
| ${{ steps.yarn-cache-dir-path.outputs.dir }} | |
| node_modules | |
| key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }} | |
| ${{ runner.os }}-build-${{ env.cache-version }}- | |
| - name: yarn install | |
| env: | |
| GATSBY_GITHUB_CLIENT_SECRET: ${{secrets.GATSBY_GITHUB_CLIENT_SECRET}} | |
| GATSBY_GITHUB_CLIENT_ID: ${{secrets.GATSBY_GITHUB_CLIENT_ID}} | |
| GATSBY_ALGOLIA_SEARCH_API_KEY: ${{secrets.GATSBY_ALGOLIA_SEARCH_API_KEY}} | |
| GATSBY_ALGOLIA_INDEX_NAME: ${{secrets.GATSBY_ALGOLIA_INDEX_NAME}} | |
| GATSBY_ALGOLIA_APP_ID: ${{secrets.GATSBY_ALGOLIA_APP_ID}} | |
| GATSBY_ALGOLIA_ADMIN_API_KEY: ${{secrets.GATSBY_ALGOLIA_ADMIN_API_KEY}} | |
| GATSBY_GITHUB_SHA: ${{ github.sha }} | |
| FAUNADB_SERVER_SECRET: ${{secrets.FAUNADB_SERVER_SECRET}} | |
| NETLIFY_ENV: deploy-preview | |
| NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}} | |
| run: | | |
| yarn install --frozen-lockfile | |
| yarn global add snyk | |
| - name: yarn build | |
| env: | |
| GATSBY_GITHUB_CLIENT_SECRET: ${{secrets.GATSBY_GITHUB_CLIENT_SECRET}} | |
| GATSBY_GITHUB_CLIENT_ID: ${{secrets.GATSBY_GITHUB_CLIENT_ID}} | |
| GATSBY_ALGOLIA_SEARCH_API_KEY: ${{secrets.GATSBY_ALGOLIA_SEARCH_API_KEY}} | |
| GATSBY_ALGOLIA_INDEX_NAME: ${{secrets.GATSBY_ALGOLIA_INDEX_NAME}} | |
| GATSBY_ALGOLIA_APP_ID: ${{secrets.GATSBY_ALGOLIA_APP_ID}} | |
| GATSBY_ALGOLIA_ADMIN_API_KEY: ${{secrets.GATSBY_ALGOLIA_ADMIN_API_KEY}} | |
| GATSBY_GITHUB_SHA: ${{ github.sha }} | |
| FAUNADB_SERVER_SECRET: ${{secrets.FAUNADB_SERVER_SECRET}} | |
| NETLIFY_ENV: deploy-preview | |
| run: yarn build | |
| - name: build docker image | |
| run: docker build -t test-blog -f owasp/Dockerfile . | |
| - name: run snyk | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| run: | | |
| snyk test . > snyk.txt || : | |
| snyk code test . > snyk_code.txt || : | |
| snyk iac test terraform > snyk_iac.txt || : | |
| snyk container test test-blog > snyk_container.txt || : | |
| - name: summarize | |
| run: | | |
| cat snyk.txt | |
| cat snyk_code.txt | |
| cat snyk_iac.txt | |
| cat snyk_container.txt | |
| touch summarize.txt | |
| echo '# Snyk vulnerability report' >> summarize.txt | |
| echo '## OSS packages' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '<details>' >> summarize.txt | |
| cat snyk.txt | sed -z 's/\n/\\n/g' >> summarize.txt | |
| echo '</details>' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '## Application' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '<details>' >> summarize.txt | |
| cat snyk_code.txt | sed -z 's/\n/\\n/g' >> summarize.txt | |
| echo '</details>' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '## IaC' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '<details>' >> summarize.txt | |
| echo '' >> summarize.txt | |
| cat snyk_iac.txt | sed -z 's/\n/\\n/g' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '</details>' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '## Container' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '' >> summarize.txt | |
| echo '<details>' >> summarize.txt | |
| cat snyk_container.txt | sed -z 's/\n/\\n/g' >> summarize.txt | |
| echo '</details>' >> summarize.txt | |
| echo '' >> summarize.txt | |
| sed -i -z 's/\n/\\n/g' summarize.txt | |
| sed -i 's/Testing \.\.\.\.//g' summarize.txt | |
| sed -i 's/Testing \. \.\.\.//g' summarize.txt | |
| - name: Post snyk Report Comment | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| URL: ${{ github.event.pull_request.comments_url }} | |
| run: | | |
| curl -X POST \ | |
| -H "Authorization: token ${GITHUB_TOKEN}" \ | |
| -d "{\"body\": \"$(cat summarize.txt)\"}" \ | |
| "${URL}" |