Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Expand file tree

/

sync_snyk-monitor.yml

Copy path
View runs
More file actions
More file actions

Latest commit

 

History

History
History
63 lines (58 loc) · 2.26 KB
/

sync_snyk-monitor.yml

Copy path

File metadata and controls

63 lines (58 loc) · 2.26 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
name: Sync Snyk Monitoring
on:
workflow_dispatch:
push:
branches: [master]
paths:
- '.github/workflows/sync_snyk-monitor.yml'
- '**/.snyk'
- '**/package.json'
- 'yarn.lock'
# This workflow synchronizes the packages in this repo along with policies in
# each .snyk file with the remote state in our snyk org. It allows us to define
# ignore policies in the .snyk files and then have them show up in the snyk web
# UI, and also automatically adds any new packages that are created.
permissions:
contents: read
jobs:
sync:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
with:
egress-policy: audit
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Monitor and Synchronize Snyk Policies
uses: snyk/actions/node@6312a53377a551c0258438bf25fb8f378afbc977 # master
with:
command: monitor
args: >
--yarn-workspaces
--org=backstage-dgh
--strict-out-of-sync=false
--remote-repo-url=https://github.com/backstage/backstage
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
NODE_OPTIONS: --max-old-space-size=7168
# Above we run the `monitor` command, this runs the `test` command which is
# the one that generates the SARIF report that we can upload to GitHub.
- name: Create Snyk report
uses: snyk/actions/node@6312a53377a551c0258438bf25fb8f378afbc977 # master
continue-on-error: true # To make sure that SARIF upload gets called
with:
args: >
--yarn-workspaces
--org=backstage-dgh
--strict-out-of-sync=false
--sarif-file-output=snyk.sarif
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
NODE_OPTIONS: --max-old-space-size=7168
- name: Upload Snyk report
uses: github/codeql-action/upload-sarif@5cf07d8b700b67e235fbb65cbc84f69c0cf10464 # v3.25.14
with:
sarif_file: snyk.sarif
Morty Proxy This is a proxified and sanitized view of the page, visit original site.