Skip to content
Snyk

fix #213

Sign in to view logs

fix

fix #213

Workflow file for this run

.github/workflows/snyk.yml at 6d653c2
name: Snyk
on:
workflow_dispatch:
pull_request:
branches:
- master
paths:
- functions/**
- src/**
- test/**
- terraform/**
- '!src/content/**'
env:
cache-version: v2
jobs:
snyk:
runs-on: ubuntu-latest
steps:
- name: Checkout source code
uses: actions/checkout@v3
- name: Setup Node
uses: actions/setup-node@v3
with:
node-version: 18.17.0
registry-url: https://npm.pkg.github.com/
scope: '@tubone24'
- name: Get yarn cache directory path
id: yarn-cache-dir-path
run: echo "dir=$(yarn cache dir)" >> "${GITHUB_OUTPUT}"
- name: Cache
uses: actions/cache/restore@v3
with:
path: |
~/.cache
${{ steps.yarn-cache-dir-path.outputs.dir }}
node_modules
key: ${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
restore-keys: |
${{ runner.os }}-build-${{ env.cache-version }}-${{ hashFiles('**/yarn.lock') }}
${{ runner.os }}-build-${{ env.cache-version }}-
- name: yarn install
env:
GATSBY_GITHUB_CLIENT_SECRET: ${{secrets.GATSBY_GITHUB_CLIENT_SECRET}}
GATSBY_GITHUB_CLIENT_ID: ${{secrets.GATSBY_GITHUB_CLIENT_ID}}
GATSBY_ALGOLIA_SEARCH_API_KEY: ${{secrets.GATSBY_ALGOLIA_SEARCH_API_KEY}}
GATSBY_ALGOLIA_INDEX_NAME: ${{secrets.GATSBY_ALGOLIA_INDEX_NAME}}
GATSBY_ALGOLIA_APP_ID: ${{secrets.GATSBY_ALGOLIA_APP_ID}}
GATSBY_ALGOLIA_ADMIN_API_KEY: ${{secrets.GATSBY_ALGOLIA_ADMIN_API_KEY}}
GATSBY_GITHUB_SHA: ${{ github.sha }}
FAUNADB_SERVER_SECRET: ${{secrets.FAUNADB_SERVER_SECRET}}
NETLIFY_ENV: deploy-preview
NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
run: |
yarn install --frozen-lockfile
yarn global add snyk
- name: yarn build
env:
GATSBY_GITHUB_CLIENT_SECRET: ${{secrets.GATSBY_GITHUB_CLIENT_SECRET}}
GATSBY_GITHUB_CLIENT_ID: ${{secrets.GATSBY_GITHUB_CLIENT_ID}}
GATSBY_ALGOLIA_SEARCH_API_KEY: ${{secrets.GATSBY_ALGOLIA_SEARCH_API_KEY}}
GATSBY_ALGOLIA_INDEX_NAME: ${{secrets.GATSBY_ALGOLIA_INDEX_NAME}}
GATSBY_ALGOLIA_APP_ID: ${{secrets.GATSBY_ALGOLIA_APP_ID}}
GATSBY_ALGOLIA_ADMIN_API_KEY: ${{secrets.GATSBY_ALGOLIA_ADMIN_API_KEY}}
GATSBY_GITHUB_SHA: ${{ github.sha }}
FAUNADB_SERVER_SECRET: ${{secrets.FAUNADB_SERVER_SECRET}}
NETLIFY_ENV: deploy-preview
run: yarn build
- name: build docker image
run: docker build -t test-blog -f owasp/Dockerfile .
- name: run snyk
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
run: |
snyk test . > snyk.txt || :
snyk code test . > snyk_code.txt || :
snyk iac test terraform > snyk_iac.txt || :
snyk container test test-blog > snyk_container.txt || :
- name: summarize
run: |
cat snyk.txt
cat snyk_code.txt
cat snyk_iac.txt
cat snyk_container.txt
touch summarize.txt
echo '# Snyk vulnerability report' >> summarize.txt
echo '## OSS packages' >> summarize.txt
echo '' >> summarize.txt
echo '' >> summarize.txt
echo '<details>' >> summarize.txt
cat snyk.txt | sed -z 's/\n/\\n/g' >> summarize.txt
echo '</details>' >> summarize.txt
echo '' >> summarize.txt
echo '' >> summarize.txt
echo '## Application' >> summarize.txt
echo '' >> summarize.txt
echo '' >> summarize.txt
echo '<details>' >> summarize.txt
cat snyk_code.txt | sed -z 's/\n/\\n/g' >> summarize.txt
echo '</details>' >> summarize.txt
echo '' >> summarize.txt
echo '' >> summarize.txt
echo '## IaC' >> summarize.txt
echo '' >> summarize.txt
echo '' >> summarize.txt
echo '<details>' >> summarize.txt
echo '' >> summarize.txt
cat snyk_iac.txt | sed -z 's/\n/\\n/g' >> summarize.txt
echo '' >> summarize.txt
echo '</details>' >> summarize.txt
echo '' >> summarize.txt
echo '' >> summarize.txt
echo '## Container' >> summarize.txt
echo '' >> summarize.txt
echo '' >> summarize.txt
echo '<details>' >> summarize.txt
cat snyk_container.txt | sed -z 's/\n/\\n/g' >> summarize.txt
echo '</details>' >> summarize.txt
echo '' >> summarize.txt
sed -i -z 's/\n/\\n/g' summarize.txt
sed -i 's/Testing \.\.\.\.//g' summarize.txt
sed -i 's/Testing \. \.\.\.//g' summarize.txt
- name: Post snyk Report Comment
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
URL: ${{ github.event.pull_request.comments_url }}
run: |
curl -X POST \
-H "Authorization: token ${GITHUB_TOKEN}" \
-d "{\"body\": \"$(cat summarize.txt)\"}" \
"${URL}"