feat(renovate): onboard Renovate with fleet-standard config #127
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | ||
|
Check failure on line 1 in .github/workflows/security-snyk.yml
|
||
| # Front-Matter for GitHub Workflow | ||
| title: "Unified Snyk Security Scan" | ||
| name: "security-snyk.yml" | ||
| description: > | ||
| Unified Snyk security pipeline: Code, OSS & Container scans via Nox; artifacts via SARIF | ||
| category: security | ||
| usage: "Triggered on push to main, pull requests, and manual workflow dispatch" | ||
| behavior: "Runs Snyk security scans for code, OSS, and container, and reports findings in SARIF format" | ||
| inputs: "Python source code, dependencies, container images" | ||
| outputs: "SARIF reports and security labels" | ||
| dependencies: "Snyk, Node.js, Poetry, GitHub Actions" | ||
| author: "Byron Williams" | ||
| last_modified: "2023-11-15" | ||
| changelog: "Updated to conform to annotation spec format" | ||
| tags: [security, snyk, analysis, sarif, code, oss, container] | ||
| --- | ||
| name: Security – Unified Snyk CI | ||
| on: | ||
| push: | ||
| branches: ["main"] | ||
| pull_request: | ||
| branches: ["main"] | ||
| workflow_dispatch: {} | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| issues: write | ||
| security-events: write | ||
| env: | ||
| PR_LABEL: status:security-failed | ||
| jobs: | ||
| prepare: | ||
| name: Prepare Poetry & Assured OSS | ||
| uses: ./.github/workflows/templates/prepare-poetry.yml | ||
| with: | ||
| GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} | ||
| secrets: | ||
| GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }} | ||
| snyk_scan: | ||
| name: Snyk Scan – ${{ matrix.target.name }} | ||
| needs: prepare | ||
| runs-on: ubuntu-22.04 | ||
| strategy: | ||
| matrix: | ||
| target: | ||
| - name: code | ||
| session: snyk_code | ||
| sarif: docs/reports/sarif/snyk-code.sarif | ||
| - name: oss | ||
| session: snyk_oss | ||
| sarif: docs/reports/sarif/snyk-oss.sarif | ||
| - name: container | ||
| session: snyk_container | ||
| sarif: docs/reports/sarif/snyk-container.sarif | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| - name: Verify no public PyPI fallbacks | ||
| run: poetry run nox -s verify_assured | ||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "20" | ||
| cache: "npm" | ||
| - name: Run Snyk session | ||
| run: poetry run nox -s ${{ matrix.target.session }} | ||
| - name: Upload SARIF report | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: snyk-${{ matrix.target.name }}-sarif | ||
| path: ${{ matrix.target.sarif }} | ||
| retention-days: 2 | ||
| - name: Upload SARIF → Security tab | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: ${{ matrix.target.sarif }} | ||
