ci: add various scan & enforce them #34
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
louis-bompart
requested review from
a team,
GermainBergeron and
aiheon
and removed request for
a team
louis-bompart
force-pushed
the
ci/#20
branch
2 times, most recently
from
5eaa99b to
4741156
Compare
louis-bompart
force-pushed
the
ci/#20
branch
3 times, most recently
from
ba3dce1 to
86eb376
Compare
louis-bompart
force-pushed
the
main
branch
2 times, most recently
from
f7d9078 to
9516656
Compare
|
Needs #36 to resync package-lock.json, which will allow snyk dependency scan to work properly |
GermainBergeron
approved these changes
May 25, 2022
Oh yeah. Tho I'll check again it seems it's been added very very recently. OneMoreTry ™️ |
. There's the concept of composite actions, that I wanted to use for that... But they do not support the 
Co-authored-by: Germain Bergeron <[email protected]>
|
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a GHA composite action that runs Snyk and Snyk Code
Add aforementioned action to the CI job. In the case of the CI, the goal is only to report (so this is why there's a
continue-on-error). The enforcing is done using the checks that this generates. You can see an example in the coveo/cli: https://github.com/coveo/cli/pull/794/checks?check_run_id=6525846881. The boon of this method is that it allows PR to come in if they do not worsen the project (so if the project were to have a vuln detected, it will not grind the CI to a halt).Add the action to the CD, but this time, it'll crash if there's unaddressed vulnerability.
fixes #20