chore: add Snyk security scanning and dependency review workflows#289
chore: add Snyk security scanning and dependency review workflows#289c-warren wants to merge 1 commit into
Conversation
CI failed: The CI workflow is failing because it references an invalid Snyk action path that does not exist in the repository's configuration.OverviewA single failure pattern was identified in the Snyk security workflow setup, where the GitHub Action runner cannot locate the specified action definition, causing the job to fail immediately. FailuresInvalid Snyk Action Path (confidence: high)
Summary
Code Review
|
| Auto-apply | Compact |
|
|
Was this helpful? React with 👍 / 👎 | Gitar
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
| - uses: actions/checkout@v4 | ||
| - name: Run Snyk to check for vulnerabilities | ||
| if: github.event_name == 'pull_request' | ||
| uses: snyk/actions/gradle-jdk8@master |
There was a problem hiding this comment.
⚠️ Security: Snyk action pinned to mutable @master ref
The snyk/actions/gradle-jdk8@master reference (lines 19 and 32) tracks a mutable branch. A compromised or force-pushed upstream master could inject arbitrary code into the workflow with access to the SNYK_TOKEN secret and security-events: write permission. Pin to a specific commit SHA (or at minimum a release tag) to prevent supply-chain attacks.
The actions/checkout@v4 and other actions already use tags; Snyk should follow the same pattern.
Pin the Snyk action to a specific commit SHA (look up the latest release SHA from https://github.com/snyk/actions/releases and substitute it).:
- uses: snyk/actions/gradle-jdk8@<full-commit-sha> # tag: vX.Y.Z
Was this helpful? React with 👍 / 👎
| - name: Run Snyk to check for vulnerabilities | ||
| if: github.event_name == 'pull_request' | ||
| uses: snyk/actions/gradle-jdk8@master | ||
| continue-on-error: true | ||
| env: | ||
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | ||
| with: | ||
| args: --severity-threshold=high --sarif-file-output=snyk.sarif | ||
| - name: Upload result to GitHub Code Scanning | ||
| if: github.event_name == 'pull_request' | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: snyk.sarif | ||
| - name: Monitor on default branch | ||
| if: github.event_name == 'push' |
There was a problem hiding this comment.
⚠️ Edge Case: SARIF upload fails if snyk step is skipped on push
On a push event the Snyk scan step (line 17-28) is skipped due to if: github.event_name == 'pull_request', so snyk.sarif is never created. The upload step (line 25-28) also has the same if guard, so today it won't run — but if that guard is ever removed or if a future step references the file, the job would fail. More importantly, on push the snyk monitor step (line 30) runs but produces no SARIF, so code-scanning results for the default branch are never uploaded to the Security tab. Consider running both snyk test --sarif-file-output and snyk monitor on push events (or uploading on push as well) so that the Security tab reflects the default-branch state.
Run the scan + SARIF upload unconditionally (on both push and PR) so the Security tab is populated for the default branch too, and keep monitor only on push.:
- name: Run Snyk to check for vulnerabilities
uses: snyk/actions/gradle-jdk8@<pinned-sha>
continue-on-error: true
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --severity-threshold=high --sarif-file-output=snyk.sarif
- name: Upload result to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: snyk.sarif
- name: Monitor on default branch
if: github.event_name == 'push'
uses: snyk/actions/gradle-jdk8@<pinned-sha>
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
command: monitor
Was this helpful? React with 👍 / 👎
|
Closing in favour of Snyk's native GitHub integration |
1 participant
Summary
snyk monitoron pushes to the default branch to register a dependency snapshot in Snyk for ongoing trackingdependency-review-actionon PRs to surface newly introduced dependencies and any known vulnerabilities in themPrerequisites
SNYK_TOKENmust be added to this repository's GitHub Actions secrets (Settings → Secrets and variables → Actions) before the Snyk jobs will succeed.