chore: setup snyk

brc-dd · May 18, 2024 · e0b7e17 · e0b7e17
1 parent 7cacbfc
commit e0b7e17
Showing 1 changed file with 23 additions and 0 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -66,3 +66,26 @@ jobs:
         with:
           sarif_file: devskim-results.sarif
           category: devskim
+
+  snyk:
+    name: snyk
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+      - uses: snyk/actions/setup
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      - run: snyk monitor --all-projects
+      - run: snyk code test $(realpath src) --sarif > snyk-results.sarif || true
+      - uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: snyk-results.sarif
+          category: snyk