AUDIT-CONFIG.md

Audit modules configuration

Properties

• audit (object): Cannot contain additional properties.
  • enabled (boolean): Default: true.
  • snyk (object): Cannot contain additional properties.
    • enabled (boolean): Enable Snyk audit. Default: true.
    • files-no-install (array): Dependency files that will not be installed. Default: [].
      • Items (string)
    • excluded-files (array): List of regex patterns for file names to exclude from the transversal dashboard and security advisories. Default: [].
      • Items (string)
    • dashboard-severity-threshold (string): Minimum severity level to display on the transversal dashboard (low, medium, high, critical). Must be one of: "low", "medium", "high", or "critical". Default: "medium".
    • advisory-severity-threshold (string): Minimum severity level to create a GitHub Security Advisory (low, medium, high, critical). Must be one of: "low", "medium", "high", or "critical". Default: "high".
    • pip-install-arguments (array): Arguments to pass to pip install. Default: [].
      • Items (string)
    • pipenv-sync-arguments (array): Arguments to pass to pipenv sync. Default: [].
      • Items (string)
    • poetry-install-arguments (array): Arguments to pass to pip install. Default: [].
      • Items (string)
    • java-path-for-gradle (object): Path to the directory that contains Java executable to use for the Gradle minor version. Can contain additional properties. Default: {}.
      • Additional properties (string)
    • monitor-arguments (array): Arguments to pass to Snyk monitor. Default: ["--all-projects"].
      • Items (string)
    • test-arguments (array): Arguments to pass to Snyk test. Default: ["--all-projects", "--severity-threshold=medium"].
      • Items (string)
    • fix-arguments (array): Arguments to pass to Snyk fix. Default: ["--all-projects"].
      • Items (string)
    • monitor (object): Cannot contain additional properties.
      • project-environment (array): Set the project environment project attribute. To clear the project environment set empty array. For more information see Project attributes https://docs.snyk.io/getting-started/introduction-to-snyk-projects/view-project-information/project-attributes.
        • Items (string): Must be one of: "frontend", "backend", "internal", "external", "mobile", "saas", "onprem", "hosted", or "distributed".
      • project-lifecycle (array): Set the project lifecycle project attribute. To clear the project lifecycle set empty array. For more information see Project attributes https://docs.snyk.io/snyk-admin/snyk-projects/project-tags.
        • Items (string): Must be one of: "production", "development", or "sandbox".
      • project-business-criticality (array): Set the project business criticality project attribute. To clear the project business criticality set empty array. For more information see Project attributes https://docs.snyk.io/snyk-admin/snyk-projects/project-tags.
        • Items (string): Must be one of: "critical", "high", "medium", or "low".
      • project-tags (object): Set the project tags to one or more values. To clear the project tags set empty dictionary. Can contain additional properties.
        • Additional properties (string)
  • dpkg (object): Cannot contain additional properties.
    • enabled (boolean): Enable dpkg audit. Default: true.
    • sources (object): Can contain additional properties. Default: {"ubuntu_22_04": [{"url": "http://archive.ubuntu.com/ubuntu", "distribution": "jammy", "components": ["main", "restricted", "universe", "multiverse"]}, {"url": "http://security.ubuntu.com/ubuntu", "distribution": "jammy-security", "components": ["main", "restricted", "universe", "multiverse"]}, {"url": "http://security.ubuntu.com/ubuntu", "distribution": "jammy-updates", "components": ["main", "restricted", "universe", "multiverse"]}], "ubuntu_24_04": [{"url": "http://archive.ubuntu.com/ubuntu", "distribution": "noble", "components": ["main", "restricted", "universe", "multiverse"]}, {"url": "http://security.ubuntu.com/ubuntu", "distribution": "noble-security", "components": ["main", "restricted", "universe", "multiverse"]}, {"url": "http://security.ubuntu.com/ubuntu", "distribution": "noble-updates", "components": ["main", "restricted", "universe", "multiverse"]}], "debian_11": [{"url": "http://deb.debian.org/debian", "distribution": "bullseye", "components": ["main", "contrib", "non-free"]}, {"url": "http://deb.debian.org/debian", "distribution": "bullseye-updates", "components": ["main", "contrib", "non-free"]}, {"url": "http://security.debian.org/debian-security", "distribution": "bullseye-security", "components": ["main", "contrib", "non-free"]}], "debian_12": [{"url": "http://deb.debian.org/debian", "distribution": "bookworm", "components": ["main", "contrib", "non-free"]}, {"url": "http://deb.debian.org/debian", "distribution": "bookworm-updates", "components": ["main", "contrib", "non-free"]}, {"url": "http://security.debian.org/debian-security", "distribution": "bookworm-security", "components": ["main", "contrib", "non-free"]}]}.
      • Additional properties (array)
        • Items (object)
          • url (string): URL of the source.
          • distribution (string): Distribution of the source.
          • components (array): Components of the source.
            • Items (string)
  • renovate (object): Cannot contain additional properties.
    • enabled (boolean): Enable Renovate audit. Default: true.
  • version-mapping (object): Mapping of version to the branch name. Can contain additional properties. Default: {}.
    • Additional properties (string)
  • pre-commit (object): Cannot contain additional properties.
    • enabled (boolean): Enable pre-commit audit. Default: true.
    • skip-hooks (array): List of pre-commit hooks to skip. Default: [].
      • Items (string)