This repository has been archived by the owner on Nov 29, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 9
93 lines (84 loc) · 2.79 KB
/
snyk-scan.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: Snyk Security Vulnerability Scan
on:
workflow_dispatch:
pull_request:
push:
tags:
- 'v.[0-9]+.[0-9]+.[0-9]+'
branches:
- 'master'
jobs:
snyk_scan_test:
if: ${{ github.event_name == 'pull_request' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
with:
fetch-depth: 2
- name: Check changed Deps files
uses: tj-actions/changed-files@v35
id: changed-files
with:
files: |
**/build.gradle
- uses: snyk/actions/setup@master
- uses: actions/setup-java@v3
with:
java-version: "8"
distribution: 'adopt'
- name: Snyk scan for Java dependencies
if: steps.changed-files.outputs.any_changed == 'true'
run: snyk test \
--all-projects \
-d \
--fail-on=all \
--print-deps \
--configuration-matching='^\(compile\|runtime\)'
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
snyk_scan_monitor:
if: ${{ github.event_name == 'push' }}
strategy:
matrix:
depsfiles: [
build.gradle,
common/jdbc/build.gradle,
gcp-cloud-run/build.gradle,
common/kdb-java/build.gradle,
kdb-mojo-scorer/build.gradle,
sql-jdbc-scorer/build.gradle,
common/transform/build.gradle,
local-rest-scorer/build.gradle,
common/rest-java-model/build.gradle,
common/rest-spring-api/build.gradle,
gcp-vertex-ai-mojo-scorer/build.gradle,
aws-sagemaker-hosted-scorer/build.gradle,
common/rest-jdbc-spring-api/build.gradle,
common/rest-vertex-ai-spring-api/build.gradle,
aws-lambda-scorer/lambda-template/build.gradle,
aws-lambda-scorer/terraform-recipe/build.gradle
]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: Extract github branch/tag name
shell: bash
run: echo "ref=$(echo ${GITHUB_REF##*/})" >> $GITHUB_OUTPUT
id: extract_ref
- uses: snyk/actions/setup@master
- uses: actions/setup-java@v3
with:
java-version: "8"
distribution: 'adopt'
- name: Snyk scan for Java dependencies - ${{ matrix.depsfiles }}
run: snyk monitor \
--org=driverless-ai \
--remote-repo-url=dai-deployment-templates/${{ steps.extract_ref.outputs.ref }} \
--file=${{ matrix.depsfiles }} \
--project-name=DRIVERLESS-AI/dai-deployment-templates/${{ steps.extract_ref.outputs.ref }}/${{ matrix.depsfiles }} \
-d \
--print-deps \
--configuration-matching='^\(compile\|runtime\)'
continue-on-error: true
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}