feat(security): add snyk scan

.github/workflows/build.yml

@@ -37,7 +37,7 @@ jobs:
  - name: Checkout source
  uses: actions/checkout@v3
 
- - name: Setup node
+ - name: Setup Node
  uses: actions/setup-node@v3
  with:
  node-version-file: .nvmrc

.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
  fetch-depth: 0
  persist-credentials: false
 
- - name: Setup node
+ - name: Setup Node
  uses: actions/setup-node@v3
  with:
  node-version-file: .nvmrc

.github/workflows/snyk.yml

@@ -0,0 +1,66 @@
+# Use Snyk to find and fix vulnerabilities in your GitHub repository.
+# https:/snyk/actions/
+
+name: Snyk Security
+
+on:
+ # Scan every Sunday at 1am
+ schedule:
+ - cron: '0 1 * * SUN'
+ # Scan every push to main branch
+ push:
+ branches:
+ - main
+ # Scan every pull request to main branch
+ pull_request:
+ branches:
+ - main
+
+permissions:
+ contents: read
+
+jobs:
+ snyk:
+ permissions:
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: Checkout source
+ uses: actions/checkout@v3
+
+ - name: Setup Node
+ uses: actions/setup-node@v3
+ with:
+ node-version-file: .nvmrc
+ cache: yarn
+ cache-dependency-path: yarn.lock
+
+ - name: Install dependencies
+ run: yarn install
+
+ - name: Setup Snyk
+ uses: snyk/actions/setup@master
+ env:
+ SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+ - name: Snyk Code Scan
+ run: snyk code test --sarif > snyk-code.sarif
+ continue-on-error: true # so that the SARIF upload gets called
+ env:
+ SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+ - name: Snyk Open Source Monitor
+ run: snyk monitor --all-projects
+ continue-on-error: true # so that the SARIF upload gets called
+ env:
+ SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+ - name: Upload results to GitHub Code Scanning
+ uses: github/codeql-action/upload-sarif@v2
+ with:
+ sarif_file: snyk-code.sarif
+ category: Snyk

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
  - name: Checkout source
  uses: actions/checkout@v3
 
- - name: Setup node
+ - name: Setup Node
  uses: actions/setup-node@v3
  with:
  node-version-file: .nvmrc