Skip to content

Commit eed6b02

Browse files
Apostles1Apostles1
authored
Create snyk-infrastructure.yml
ci-cd
1 parent 26506d5 commit eed6b02

1 file changed

Lines changed: 132 additions & 0 deletions

File tree

‎.github/workflows/snyk-infrastructure.yml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
- name: Setup Node.js environment
2+
uses: actions/setup-node@v5.0.0
3+
with:
4+
# Set always-auth in npmrc.
5+
always-auth: # optional, default is false
6+
# Version Spec of the version to use. Examples: 12.x, 10.15.1, >=10.15.0.
7+
node-version: # optional
8+
# File containing the version Spec of the version to use. Examples: package.json, .nvmrc, .node-version, .tool-versions.
9+
node-version-file: # optional
10+
# Target architecture for Node to use. Examples: x86, x64. Will use system architecture by default.
11+
architecture: # optional
12+
# Set this option if you want the action to check for the latest available version that satisfies the version spec.
13+
check-latest: # optional
14+
# Optional registry to set up for auth. Will set the registry in a project level .npmrc and .yarnrc file, and set up auth to read in from env.NODE_AUTH_TOKEN.
15+
registry-url: # optional
16+
# Optional scope for authenticating against scoped registries. Will fall back to the repository owner when using the GitHub Packages registry (https://npm.pkg.github.com/).
17+
scope: # optional
18+
# Used to pull node distributions from node-versions. Since there's a default, this is typically not supplied by the user. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.
19+
token: # optional, default is ${{ github.server_url == 'https://github.com' && github.token || '' }}
20+
# Used to specify a package manager for caching in the default directory. Supported values: npm, yarn, pnpm.
21+
cache: # optional
22+
# Set to false to disable automatic caching based on the package manager field in package.json. By default, caching is enabled if the package manager field is present.
23+
package-manager-cache: # optional, default is true
24+
# Used to specify the path to a dependency file: package-lock.json, yarn.lock, etc. Supports wildcards or a list of file names for caching multiple dependencies.
25+
cache-dependency-path: # optional
26+
# Used to specify an alternative mirror to downlooad Node.js binaries from
27+
mirror: # optional
28+
# The token used as Authorization header when fetching from the mirror
29+
mirror-token: # optional
30+
- name: Setup .NET Core SDK
31+
uses: actions/setup-dotnet@v5.0.0
32+
with:
33+
# Optional SDK version(s) to use. If not provided, will install global.json version when available. Examples: 2.2.104, 3.1, 3.1.x, 3.x, 6.0.2xx
34+
dotnet-version: # optional
35+
# Optional quality of the build. The possible values are: daily, signed, validated, preview, ga.
36+
dotnet-quality: # optional
37+
# Optional global.json location, if your global.json isn't located in the root of the repo.
38+
global-json-file: # optional
39+
# Optional package source for which to set up authentication. Will consult any existing NuGet.config in the root of the repo and provide a temporary NuGet.config using the NUGET_AUTH_TOKEN environment variable as a ClearTextPassword
40+
source-url: # optional
41+
# Optional OWNER for using packages from GitHub Package Registry organizations/users other than the current repository's owner. Only used if a GPR URL is also provided in source-url
42+
owner: # optional
43+
# Optional NuGet.config location, if your NuGet.config isn't located in the root of the repo.
44+
config-file: # optional
45+
# Optional input to enable caching of the NuGet global-packages folder
46+
cache: # optional
47+
# Used to specify the path to a dependency file: packages.lock.json. Supports wildcards or a list of file names for caching multiple dependencies.
48+
cache-dependency-path: # optional
49+
- name: Setup .NET Core SDK
50+
uses: actions/setup-dotnet@v5.0.0
51+
with:
52+
# Optional SDK version(s) to use. If not provided, will install global.json version when available. Examples: 2.2.104, 3.1, 3.1.x, 3.x, 6.0.2xx
53+
dotnet-version: # optional
54+
# Optional quality of the build. The possible values are: daily, signed, validated, preview, ga.
55+
dotnet-quality: # optional
56+
# Optional global.json location, if your global.json isn't located in the root of the repo.
57+
global-json-file: # optional
58+
# Optional package source for which to set up authentication. Will consult any existing NuGet.config in the root of the repo and provide a temporary NuGet.config using the NUGET_AUTH_TOKEN environment variable as a ClearTextPassword
59+
source-url: # optional
60+
# Optional OWNER for using packages from GitHub Package Registry organizations/users other than the current repository's owner. Only used if a GPR URL is also provided in source-url
61+
owner: # optional
62+
# Optional NuGet.config location, if your NuGet.config isn't located in the root of the repo.
63+
config-file: # optional
64+
# Optional input to enable caching of the NuGet global-packages folder
65+
cache: # optional
66+
# Used to specify the path to a dependency file: packages.lock.json. Supports wildcards or a list of file names for caching multiple dependencies.
67+
cache-dependency-path: # optional
68+
- name: wipac-dev-project-action
69+
# You may pin to the exact commit or the version.
70+
# uses: WIPACrepo/wipac-dev-project-action@d8636a2c0b4321ca5e3bb37d4c3eaeeb7df01775
71+
uses: WIPACrepo/wipac-dev-project-action@v1.0
72+
with:
73+
# a PAT with project write permissions
74+
github_token: # default is
75+
# the organization of the project
76+
organization: # default is
77+
# the id of the project (see url)
78+
project_number: # default is
79+
# This workflow uses actions that are not certified by GitHub.
80+
# They are provided by a third-party and are governed by
81+
# separate terms of service, privacy policy, and support
82+
# documentation.
83+
84+
# A sample workflow which checks out your Infrastructure as Code Configuration files,
85+
# such as Kubernetes, Helm & Terraform and scans them for any security issues.
86+
# The results are then uploaded to GitHub Security Code Scanning
87+
#
88+
# For more examples, including how to limit scans to only high-severity issues
89+
# and fail PR checks, see https://github.com/snyk/actions/
90+
91+
name: Snyk Infrastructure as Code
92+
93+
on:
94+
push:
95+
branches: [ "main" ]
96+
pull_request:
97+
# The branches below must be a subset of the branches above
98+
branches: [ "main" ]
99+
schedule:
100+
- cron: '37 16 * * 5'
101+
102+
permissions:
103+
contents: read
104+
105+
jobs:
106+
snyk:
107+
permissions:
108+
contents: read # for actions/checkout to fetch code
109+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
110+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
111+
runs-on: ubuntu-latest
112+
steps:
113+
- uses: actions/checkout@v4
114+
- name: Run Snyk to check configuration files for security issues
115+
# Snyk can be used to break the build when it detects security issues.
116+
# In this case we want to upload the issues to GitHub Code Scanning
117+
continue-on-error: true
118+
uses: snyk/actions/iac@14818c4695ecc4045f33c9cee9e795a788711ca4
119+
env:
120+
# In order to use the Snyk Action you will need to have a Snyk API token.
121+
# More details in https://github.com/snyk/actions#getting-your-snyk-token
122+
# or you can signup for free at https://snyk.io/login
123+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
124+
with:
125+
# Add the path to the configuration file that you would like to test.
126+
# For example `deployment.yaml` for a Kubernetes deployment manifest
127+
# or `main.tf` for a Terraform configuration file
128+
file: your-file-to-test.yaml
129+
- name: Upload result to GitHub Code Scanning
130+
uses: github/codeql-action/upload-sarif@v3
131+
with:
132+
sarif_file: snyk.sarif

0 commit comments

Comments
 (0)