issue/194: Add snyk scan to cicd workflow

.github/workflows/cicd-pipeline.yml

@@ -169,6 +169,26 @@ jobs:
             -Dsonar.projectName=${{ github.repository }}
             -Dsonar.projectVersion=${{ env.software_version }}
             -Dsonar.python.version=3.12
+      - name: Run Snyk as a blocking step
+        uses: snyk/actions/python-3.12@master
+        env:
+            SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          command: test
+          args: >
+              --org=${{ secrets.SNYK_ORG_ID }}
+              --project-name=${{ github.repository }}
+              --severity-threshold=high
+              --fail-on=all
+      - name: Run Snyk on Python
+        uses: snyk/actions/python-3.12@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          command: monitor
+          args: >
+            --org=${{ secrets.SNYK_ORG_ID }}
+            --project-name=${{ github.repository }}
       - name: Build Python Artifact
         id: poetry-build
         run: |
@@ -229,6 +249,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       packages: write
+      security-events: write
     needs: build
     outputs:
       container_image_uri: ${{ steps.set-outputs.outputs.container_image_uri }}
@@ -265,6 +286,45 @@ jobs:
           provenance: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+      - name: Set up Snyk CLI
+        uses: snyk/actions/setup@master
+      - name: Run Snyk on Docker Image
+        # Use the modern `snyk container test` subcommand directly instead of the
+        # snyk/actions/docker action. That action runs legacy `snyk test --docker`,
+        # which (a) executes inside a container with no `python`, tripping over the
+        # repo's pyproject.toml, and (b) mishandles `--file`, treating the Dockerfile
+        # as an open-source manifest ("Could not detect package manager").
+        # `snyk container test` targets only the image, reads the Dockerfile via
+        # --file for base-image upgrade advice, and reliably writes SARIF for upload
+        # to GitHub Code Scanning. continue-on-error keeps a vulnerable image (or a
+        # scan error) from failing the build.
+        continue-on-error: true
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+          IMAGE_URI: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
+        run: |
+          snyk container test "$IMAGE_URI" \
+            --file=docker/Dockerfile \
+            --severity-threshold=high \
+            --sarif-file-output=snyk.sarif
+      - name: Normalize Snyk SARIF for GitHub Code Scanning
+        # Snyk emits some rules (e.g. license findings) with a null
+        # "security-severity", which GitHub Code Scanning rejects during processing
+        # ("invalid security severity value, is not a number: null"). Coerce any
+        # null/"undefined" value to "0" so the SARIF is accepted.
+        if: ${{ always() && hashFiles('snyk.sarif') != '' }}
+        run: |
+          jq '(.runs[]?.tool.driver.rules[]?.properties."security-severity") |= (if (. == null or . == "undefined") then "0" else . end)' \
+            snyk.sarif > snyk.sarif.tmp && mv snyk.sarif.tmp snyk.sarif
+      - name: Upload Snyk result to GitHub Code Scanning
+        # Always attempt to upload, even if the Snyk scan found vulnerabilities and
+        # exited non-zero. Guarded on the SARIF file existing so that a scan which
+        # fails to produce output does not fail the whole job.
+        if: ${{ always() && hashFiles('snyk.sarif') != '' }}
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: snyk.sarif
+
       - name: Set output
         id: set-outputs
         run: |

CHANGELOG.md

@@ -7,11 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 ### Added
+- [issue/194](https://github.com/podaac/bignbit/issues/194): Add snyk security scanning after the python and docker build steps of the cicd-pipeline github action workflow.
 ### Changed
 ### Deprecated
 ### Removed
 ### Fixed
+- Fixed minor bug where variable lists (e.g. 'u,v') are properly passed to harmony in submit_harmony_job lambda
 ### Security
+- [issue/194](https://github.com/podaac/bignbit/issues/194): Address critical and high security vulnerabilities found by snyk scan of python module and docker image.
+- [issue/194](https://github.com/podaac/bignbit/issues/194): Upgrade all inherited OS packages in the Docker image to the latest Ubuntu security releases to clear critical CVEs (curl/libcurl, gnutls, glibc, ...) reported by ECR/Inspector image scanning.
 
 ## [0.8.1]
 ### Added

bignbit/submit_harmony_job.py

@@ -98,11 +98,15 @@ def determine_output_dimensions(big_config, output_crs):
 
 def generate_harmony_request(collection_concept_id, granule_concept_id, variable, output_width, output_height, output_crs, big_config, destination_bucket_url):
     """Generate the harmony request to be made and return request object"""
+    if ',' in variable:
+        variable_list = variable.split(',')
+    else:
+        variable_list = [variable]
 
     kwargs = {
         'collection': Collection(id=collection_concept_id),
         'granule_id': [granule_concept_id],
-        'variables': [variable],
+        'variables': variable_list,
         'format': big_config['config'].get('format', 'image/png'),
         'destination_url': destination_bucket_url,
         'labels': ['bignbit']

docker/Dockerfile

@@ -48,6 +48,15 @@ RUN mkdir -p "${FUNCTION_DIR}" && \
 
 FROM ghcr.io/osgeo/gdal:ubuntu-small-${GDAL_VERSION}
 ARG FUNCTION_DIR
+# Patch known-vulnerable OS packages inherited from the base image. ECR/Inspector and Snyk
+# repeatedly flag CRITICAL CVEs in OS packages that GDAL pulls in transitively (openssl/libssl,
+# curl/libcurl, gnutls, glibc, ...). Rather than enumerate each package, upgrade every installed
+# package to the latest Ubuntu security release for this base's Ubuntu series so newly disclosed
+# CVEs are picked up on rebuild. Must run as root, before switching users.
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get dist-upgrade -y && \
+    rm -rf /var/lib/apt/lists/*
 RUN useradd --create-home --home-dir /home/dockeruser --shell /bin/sh --uid 993 --user-group --comment "" dockeruser
 USER dockeruser
 ENV HOME=/home/dockeruser