Cross-language parity: unified case-insensitive pattern superset, TS harmful-content check, strict parse (#30) #132
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Snyk Security | |
| on: | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 9 * * 1' | |
| jobs: | |
| snyk-dependencies: | |
| name: Snyk Dependency Scan | |
| runs-on: ubuntu-latest | |
| if: > | |
| (github.event_name != 'pull_request' || | |
| github.event.pull_request.head.repo.fork == false) && | |
| github.actor != 'dependabot[bot]' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Set up Python | |
| uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0 | |
| with: | |
| python-version: '3.11' | |
| - name: Install Snyk CLI | |
| run: npm install -g snyk@1.1297.2 | |
| - name: Install Python dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . | |
| - name: Install npm dependencies | |
| run: npm ci --prefix npm | |
| - name: Generate requirements for Snyk | |
| run: pip freeze > requirements.txt | |
| - name: Run Snyk to check Python vulnerabilities | |
| continue-on-error: ${{ github.event_name == 'schedule' }} | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| SNYK_ORG: ${{ secrets.SNYK_ORG_ID }} | |
| run: snyk test --file=requirements.txt --org="$SNYK_ORG" --severity-threshold=high --sarif-file-output=snyk-python.sarif | |
| - name: Run Snyk to check npm vulnerabilities | |
| if: always() | |
| continue-on-error: ${{ github.event_name == 'schedule' }} | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| SNYK_ORG: ${{ secrets.SNYK_ORG_ID }} | |
| run: snyk test --file=npm/package.json --org="$SNYK_ORG" --severity-threshold=high --sarif-file-output=snyk-npm.sarif | |
| - name: Cleanup | |
| run: rm requirements.txt | |
| - name: Upload Snyk Python results | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4 | |
| if: always() && hashFiles('snyk-python.sarif') != '' | |
| with: | |
| sarif_file: snyk-python.sarif | |
| category: snyk-python | |
| - name: Upload Snyk npm results | |
| if: always() && hashFiles('snyk-npm.sarif') != '' | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4 | |
| with: | |
| sarif_file: snyk-npm.sarif | |
| category: snyk-npm | |
| snyk-code: | |
| name: Snyk Code Analysis (SAST) | |
| runs-on: ubuntu-latest | |
| if: > | |
| (github.event_name != 'pull_request' || | |
| github.event.pull_request.head.repo.fork == false) && | |
| github.actor != 'dependabot[bot]' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Install Snyk CLI | |
| run: npm install -g snyk@1.1297.2 | |
| - name: Run Snyk Code test | |
| continue-on-error: ${{ github.event_name == 'schedule' }} | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| SNYK_ORG: ${{ secrets.SNYK_ORG_ID }} | |
| run: snyk code test --org="$SNYK_ORG" --severity-threshold=high --exclude="npm/node_modules" --sarif-file-output=snyk-code.sarif | |
| - name: Upload Snyk Code results | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4 | |
| if: always() && hashFiles('snyk-code.sarif') != '' | |
| with: | |
| sarif_file: snyk-code.sarif |