diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b477b7fb8f..668d24829e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,5 +23,20 @@ jobs: - uses: actions/checkout@master - name: Run Snyk to check for vulnerabilities uses: snyk/actions/golang@master + with: + args: --org=${{ secrets.SNYK_ORG }} --severity-threshold=high + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + + snyk-code: + name: Snyk Code + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@master + - name: Run Snyk SAST to check for code vulnerabilities + uses: snyk/actions/golang@master + with: + command: code test + args: --org=${{ secrets.SNYK_ORG }} env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} diff --git a/.github/workflows/deploy.devnet.yml b/.github/workflows/deploy.devnet.yml index b604014c20..37451f570f 100644 --- a/.github/workflows/deploy.devnet.yml +++ b/.github/workflows/deploy.devnet.yml @@ -18,6 +18,7 @@ jobs: uses: 0xpolygon/polygon-edge/.github/workflows/security.yml@develop secrets: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + SNYK_ORG: ${{ secrets.SNYK_ORG }} build: name: Build diff --git a/.github/workflows/deploy.testnet.yml b/.github/workflows/deploy.testnet.yml index 6dd05c2f6e..41bd8c44b4 100644 --- a/.github/workflows/deploy.testnet.yml +++ b/.github/workflows/deploy.testnet.yml @@ -17,6 +17,7 @@ jobs: uses: 0xpolygon/polygon-edge/.github/workflows/security.yml@develop secrets: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + SNYK_ORG: ${{ secrets.SNYK_ORG }} build: uses: 0xpolygon/polygon-edge/.github/workflows/build.yml@develop diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 575e310f20..0951c65c40 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -5,6 +5,8 @@ on: # yamllint disable-line rule:truthy secrets: SNYK_TOKEN: required: true + SNYK_ORG: + required: true workflow_dispatch: {} schedule: - cron: '0 0 * * 0' @@ -23,7 +25,26 @@ jobs: env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} with: - args: --sarif-file-output=snyk.sarif + args: --org=${{ secrets.SNYK_ORG }} --sarif-file-output=snyk.sarif + - name: Upload result to GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: snyk.sarif + snyk-code: + name: Snyk Code and Publish + runs-on: ubuntu-latest + continue-on-error: true + steps: + - name: Checkout Source + uses: actions/checkout@master + - name: Run Snyk SAST to check for vulnerabilities + uses: snyk/actions/golang@master + continue-on-error: true + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + args: --org=${{ secrets.SNYK_ORG }} --sarif-file-output=snyk.sarif + command: code test - name: Upload result to GitHub Code Scanning uses: github/codeql-action/upload-sarif@v2 with: