Skip to content

chore: add Snyk security scanning and dependency review workflows #289

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
c-warren wants to merge 1 commit into from
+50 −0
Closed

chore: add Snyk security scanning and dependency review workflows #289

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions .github/workflows/snyk-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Security Scan

on:
push:
branches: [master]
pull_request:
branches: [master]

jobs:
snyk:
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- uses: actions/checkout@v4
- name: Run Snyk to check for vulnerabilities
if: github.event_name == 'pull_request'
uses: snyk/actions/gradle-jdk8@master

@gitar-bot gitar-bot Bot May 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Security: Snyk action pinned to mutable @master ref

The snyk/actions/gradle-jdk8@master reference (lines 19 and 32) tracks a mutable branch. A compromised or force-pushed upstream master could inject arbitrary code into the workflow with access to the SNYK_TOKEN secret and security-events: write permission. Pin to a specific commit SHA (or at minimum a release tag) to prevent supply-chain attacks.

The actions/checkout@v4 and other actions already use tags; Snyk should follow the same pattern.

Pin the Snyk action to a specific commit SHA (look up the latest release SHA from https://github.com/snyk/actions/releases and substitute it).:

- uses: snyk/actions/gradle-jdk8@<full-commit-sha>  # tag: vX.Y.Z

Was this helpful? React with 👍 / 👎

continue-on-error: true
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --severity-threshold=high --sarif-file-output=snyk.sarif
- name: Upload result to GitHub Code Scanning
if: github.event_name == 'pull_request'
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: snyk.sarif
- name: Monitor on default branch
if: github.event_name == 'push'
Comment on lines +17 to +31

@gitar-bot gitar-bot Bot May 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Edge Case: SARIF upload fails if snyk step is skipped on push

On a push event the Snyk scan step (line 17-28) is skipped due to if: github.event_name == 'pull_request', so snyk.sarif is never created. The upload step (line 25-28) also has the same if guard, so today it won't run — but if that guard is ever removed or if a future step references the file, the job would fail. More importantly, on push the snyk monitor step (line 30) runs but produces no SARIF, so code-scanning results for the default branch are never uploaded to the Security tab. Consider running both snyk test --sarif-file-output and snyk monitor on push events (or uploading on push as well) so that the Security tab reflects the default-branch state.

Run the scan + SARIF upload unconditionally (on both push and PR) so the Security tab is populated for the default branch too, and keep monitor only on push.:

- name: Run Snyk to check for vulnerabilities
  uses: snyk/actions/gradle-jdk8@<pinned-sha>
  continue-on-error: true
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  with:
    args: --severity-threshold=high --sarif-file-output=snyk.sarif
- name: Upload result to GitHub Code Scanning
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: snyk.sarif
- name: Monitor on default branch
  if: github.event_name == 'push'
  uses: snyk/actions/gradle-jdk8@<pinned-sha>
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  with:
    command: monitor

Was this helpful? React with 👍 / 👎

uses: snyk/actions/gradle-jdk8@master
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
command: monitor

dependency-review:
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v4
- uses: actions/dependency-review-action@v4
continue-on-error: true
with:
fail-on-severity: high
comment-summary-in-pr: always
Loading