feat: snyk

.github/workflows/build.yaml

@@ -31,3 +31,8 @@ jobs:
       - name: Lint
         run: task lint
         shell: nix develop --command bash -e {0}
+      - name: Vulns
+        run: snyk auth $SNYK_TOKEN && task vulns
+        shell: nix develop --command bash -e {0}
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

Taskfile.yml

@@ -50,16 +50,12 @@ tasks:
       - find . -name "*.db" -type f -delete
       - find . -name "*.db-shm" -type f -delete
       - find . -name "*.db-wal" -type f -delete
+  vulns:
+    cmds:
+      - snyk test
   release:
     cmds:
       - goreleaser release
   release-snapshot:
     cmds:
       - goreleaser release --snapshot --clean
-  install-native-manifest:
-    cmds:
-      - mkdir -p ~/.mozilla/native-messaging-hosts/
-      - cp armaria.json ~/.mozilla/native-messaging-hosts/
-  copy-snap:
-    cmds:
-      - scp dist/armaria_0.0.6-next_linux_amd64.snap [email protected]:/home/jhope

flake.nix

@@ -25,6 +25,7 @@
             zig.packages.${system}.master
             goreleaser
             syft
+            snyk
           ];
           shellHook = ''
             export PATH=$PWD/tools:$PATH