issue/194: Add snyk scan to cicd workflow

Author: jackiryan

.github/workflows/cicd-pipeline.yml

@@ -169,6 +169,26 @@ jobs:
             -Dsonar.projectName=${{ github.repository }}
             -Dsonar.projectVersion=${{ env.software_version }}
             -Dsonar.python.version=3.12
+      - name: Run Snyk as a blocking step
+        uses: snyk/actions/python-3.12@master
+        env:
+            SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          command: test
+          args: >
+              --org=${{ secrets.SNYK_ORG_ID }}
+              --project-name=${{ github.repository }}
+              --severity-threshold=high
+              --fail-on=all
+      - name: Run Snyk on Python
+        uses: snyk/actions/python-3.12@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          command: monitor
+          args: >
+            --org=${{ secrets.SNYK_ORG_ID }}
+            --project-name=${{ github.repository }}
       - name: Build Python Artifact
         id: poetry-build
         run: |
@@ -265,6 +285,18 @@ jobs:
           provenance: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+      - name: Run Snyk on Docker Image
+        # Snyk can be used to break the build when it detects vulnerabilities.
+        # In this case we want to upload the issues to GitHub Code Scanning
+        continue-on-error: true
+        uses: snyk/actions/docker@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          image: ${{ steps.meta.outputs.tags[0] }}
+          args: >
+            --severity-threshold=high
+
       - name: Set output
         id: set-outputs
         run: |

bignbit/submit_harmony_job.py

@@ -98,11 +98,15 @@ def determine_output_dimensions(big_config, output_crs):
 
 def generate_harmony_request(collection_concept_id, granule_concept_id, variable, output_width, output_height, output_crs, big_config, destination_bucket_url):
     """Generate the harmony request to be made and return request object"""
+    if ',' in variable:
+        variable_list = variable.split(',')
+    else:
+        variable_list = [variable]
 
     kwargs = {
         'collection': Collection(id=collection_concept_id),
         'granule_id': [granule_concept_id],
-        'variables': [variable],
+        'variables': variable_list,
         'format': big_config['config'].get('format', 'image/png'),
         'destination_url': destination_bucket_url,
         'labels': ['bignbit']

tests/test_submit_harmony_job.py

@@ -334,6 +334,28 @@ def test_generate_harmony_request_variables_list(self):
         assert result.variables[0] == variable
         assert result.labels == ['bignbit']
 
+    def test_generate_harmony_request_comma_separated_variables(self):
+        """Test that a comma-separated variable list is properly converted"""
+        collection_concept_id = 'C9999999999-POCLOUD'
+        granule_concept_id = 'G9999999999-POCLOUD'
+        variable = 'u,v'
+        output_crs = 'EPSG:3857'
+        output_width = 512
+        output_height = 512
+        big_config = {'config': {'width': 512, 'height': 512}}
+        destination_bucket_url = 's3://bucket/path'
+
+        result = generate_harmony_request(
+            collection_concept_id, granule_concept_id, variable, output_width, output_height,
+            output_crs, big_config, destination_bucket_url
+        )
+
+        assert isinstance(result.variables, list)
+        assert len(result.variables) == 2
+        assert result.variables[0] == 'u'
+        assert result.variables[1] == 'v'
+        assert result.labels == ['bignbit']
+
 
 class TestSubmitHarmonyJobIntegration:
     """Integration-style tests for submit_harmony_job module"""