From 3994bd1ae115cd619611e1b9216a91fef0b86664 Mon Sep 17 00:00:00 2001 From: Sam Hession Date: Tue, 18 Jan 2022 14:02:43 +0000 Subject: [PATCH 1/6] Adds Snyk GitHub action using CLI --- .github/workflows/snyk.yml | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/snyk.yml diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml new file mode 100644 index 000000000..3b7a74643 --- /dev/null +++ b/.github/workflows/snyk.yml @@ -0,0 +1,37 @@ +# This action runs every day at 6 AM and on every push +# If the branch it's running on is main then it will run snyk monitor (reports vulnerabilities to snyk.io) +# Otherwise it will run snyk test +name: Snyk + +on: + schedule: + - cron: "0 6 * * *" + push: + # branches: + # - main + workflow_dispatch: + +jobs: + security: + runs-on: ubuntu-latest + steps: + - name: Checkout branch + uses: actions/checkout@v2 + + - name: Get node version + run: echo NODE_VERSION=$(cat .nvmrc) >> $GITHUB_ENV + + - uses: snyk/actions/setup@0.3.0 + - uses: actions/setup-node@v2 + with: + node-version: ${{ env.NODE_VERSION }} + + - uses: actions/setup-java@v2 + with: + java-version: "8" + distribution: "adopt" + + - name: Snyk monitor + run: snyk monitor --all-projects + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} From ee285fe5a4b38a49ca4d8c9953fa1a3685aaa493 Mon Sep 17 00:00:00 2001 From: Sam Hession Date: Tue, 18 Jan 2022 15:33:00 +0000 Subject: [PATCH 2/6] Updates sbt-dependency-graph for more accurate results --- .github/workflows/snyk.yml | 4 +++- project/plugins.sbt | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index 3b7a74643..c8d69ffa3 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -30,8 +30,10 @@ jobs: with: java-version: "8" distribution: "adopt" + + - run: node --version - name: Snyk monitor - run: snyk monitor --all-projects + run: snyk monitor --all-projects -d env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} diff --git a/project/plugins.sbt b/project/plugins.sbt index 42fb6f0bc..0f6b98178 100644 --- a/project/plugins.sbt +++ b/project/plugins.sbt @@ -13,5 +13,5 @@ addSbtPlugin("com.typesafe.play" % "sbt-plugin" % "2.8.11") addSbtPlugin("com.eed3si9n" % "sbt-buildinfo" % "0.9.0") -addSbtPlugin("net.virtual-void" % "sbt-dependency-graph" % "0.9.2") +addSbtPlugin("net.virtual-void" % "sbt-dependency-graph" % "0.10.0-RC1") From 25ca116896ec6a9350655fe18a1374e2361e6ed3 Mon Sep 17 00:00:00 2001 From: Sam Hession Date: Wed, 19 Jan 2022 10:03:24 +0000 Subject: [PATCH 3/6] Removes debug steps from Snyk workflow --- .github/workflows/snyk.yml | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index c8d69ffa3..fce9ce40a 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -1,14 +1,11 @@ -# This action runs every day at 6 AM and on every push -# If the branch it's running on is main then it will run snyk monitor (reports vulnerabilities to snyk.io) -# Otherwise it will run snyk test name: Snyk on: schedule: - cron: "0 6 * * *" push: - # branches: - # - main + branches: + - main workflow_dispatch: jobs: @@ -30,10 +27,8 @@ jobs: with: java-version: "8" distribution: "adopt" - - - run: node --version - name: Snyk monitor - run: snyk monitor --all-projects -d + run: snyk monitor --all-projects env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} From 0bbf882bb5d0f9b6032dafa8082655f545f4571e Mon Sep 17 00:00:00 2001 From: Sam Hession Date: Wed, 19 Jan 2022 17:14:42 +0000 Subject: [PATCH 4/6] test reusable workflow --- .github/workflows/snyk.yml | 31 ++++++----------------------- .github/workflows/test.yml | 40 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 25 deletions(-) create mode 100644 .github/workflows/test.yml diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index fce9ce40a..d383c8fb5 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -4,31 +4,12 @@ on: schedule: - cron: "0 6 * * *" push: - branches: - - main + # branches: + # - main workflow_dispatch: jobs: - security: - runs-on: ubuntu-latest - steps: - - name: Checkout branch - uses: actions/checkout@v2 - - - name: Get node version - run: echo NODE_VERSION=$(cat .nvmrc) >> $GITHUB_ENV - - - uses: snyk/actions/setup@0.3.0 - - uses: actions/setup-node@v2 - with: - node-version: ${{ env.NODE_VERSION }} - - - uses: actions/setup-java@v2 - with: - java-version: "8" - distribution: "adopt" - - - name: Snyk monitor - run: snyk monitor --all-projects - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + security: + uses: guardian/workflow-frontend/.github/workflows/test.yml@add-snyk-workflow + secrets: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 000000000..372d1b0ed --- /dev/null +++ b/.github/workflows/test.yml @@ -0,0 +1,40 @@ +name: SBT Node Snyk + +on: + workflow_call: + inputs: + DEBUG: + type: string + required: false + secrets: + SNYK_TOKEN: + required: true + +jobs: + security: + runs-on: ubuntu-latest + steps: + - name: Checkout branch + uses: actions/checkout@v2 + + - name: Setup debug var + run: echo INPUT_DEBUG=${{ inputs.DEBUG }} >> $GITHUB_ENV + shell: bash + + - name: Get node version + run: echo NODE_VERSION=$(cat .nvmrc) >> $GITHUB_ENV + + - uses: snyk/actions/setup@0.3.0 + - uses: actions/setup-node@v2 + with: + node-version: ${{ env.NODE_VERSION }} + + - uses: actions/setup-java@v2 + with: + java-version: "8" + distribution: "adopt" + + - name: Snyk monitor + run: snyk monitor --all-projects ${INPUT_DEBUG:+ -d} + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} \ No newline at end of file From 141c6450831b23e34f085e5fa8f8f4ec108bdc29 Mon Sep 17 00:00:00 2001 From: Sam Hession Date: Wed, 19 Jan 2022 17:42:28 +0000 Subject: [PATCH 5/6] test .github workflow --- .github/workflows/snyk.yml | 4 +++- .github/workflows/test.yml | 40 -------------------------------------- 2 files changed, 3 insertions(+), 41 deletions(-) delete mode 100644 .github/workflows/test.yml diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index d383c8fb5..de64e52e1 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -10,6 +10,8 @@ on: jobs: security: - uses: guardian/workflow-frontend/.github/workflows/test.yml@add-snyk-workflow + uses: guardian/.github/.github/workflows/sbt-node-snyk.yml@add-generic-snyk-workflow + with: + DEBUG: "true" secrets: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml deleted file mode 100644 index 372d1b0ed..000000000 --- a/.github/workflows/test.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: SBT Node Snyk - -on: - workflow_call: - inputs: - DEBUG: - type: string - required: false - secrets: - SNYK_TOKEN: - required: true - -jobs: - security: - runs-on: ubuntu-latest - steps: - - name: Checkout branch - uses: actions/checkout@v2 - - - name: Setup debug var - run: echo INPUT_DEBUG=${{ inputs.DEBUG }} >> $GITHUB_ENV - shell: bash - - - name: Get node version - run: echo NODE_VERSION=$(cat .nvmrc) >> $GITHUB_ENV - - - uses: snyk/actions/setup@0.3.0 - - uses: actions/setup-node@v2 - with: - node-version: ${{ env.NODE_VERSION }} - - - uses: actions/setup-java@v2 - with: - java-version: "8" - distribution: "adopt" - - - name: Snyk monitor - run: snyk monitor --all-projects ${INPUT_DEBUG:+ -d} - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} \ No newline at end of file From 2550c9c74ee03f533f6cd56ed6505acf8e68545d Mon Sep 17 00:00:00 2001 From: Sam Hession Date: Fri, 4 Feb 2022 11:52:05 +0000 Subject: [PATCH 6/6] Adds org to reusable workflow --- .github/workflows/snyk.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index de64e52e1..07ef57aa4 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -4,14 +4,15 @@ on: schedule: - cron: "0 6 * * *" push: - # branches: - # - main + branches: + - main workflow_dispatch: jobs: security: - uses: guardian/.github/.github/workflows/sbt-node-snyk.yml@add-generic-snyk-workflow + uses: guardian/.github/.github/workflows/sbt-node-snyk.yml@main with: - DEBUG: "true" + DEBUG: true + ORG: guardian secrets: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}