chore: add Snyk scans to docs

.github/workflows/image.yaml

@@ -58,10 +58,22 @@ jobs:
         run: |
           npm install -g snyk
 
-          # Run with high threshold to fail build.
-          snyk test --org=argoproj --all-projects --exclude=docs,site --severity-threshold=high --policy-path=.snyk
-          snyk iac test manifests/install.yaml --org=argoproj --severity-threshold=high --policy-path=.snyk
-
+          ./hack/snyk-non-container-tests.sh
+      - uses: github/codeql-action/upload-sarif@v1
+        if: github.event_name == 'push'
+        with:
+          category: Snyk code scan
+          sarif_file: /tmp/argocd-test.sarif
+      - uses: github/codeql-action/upload-sarif@v1
+        if: github.event_name == 'push'
+        with:
+          category: Snyk IaC scan for cluster install manifests
+          sarif_file: /tmp/argocd-iac-test-install.sarif
+      - uses: github/codeql-action/upload-sarif@v1
+        if: github.event_name == 'push'
+        with:
+          category: Snyk IaC scan for namespace install manifests
+          sarif_file: /tmp/argocd-iac-test-namespace-install.sarif
       - run: |
           IMAGE_PLATFORMS=linux/amd64
           if [[ "${{ github.event_name }}" == "push" || "${{ contains(github.event.pull_request.labels.*.name, 'test-arm-image') }}" == "true" ]]
@@ -74,13 +86,18 @@ jobs:
             -t quay.io/argoproj/argocd:latest .
         working-directory: ./src/github.com/argoproj/argo-cd
 
-      - name: Run container Snyk scan
+      - name: Run container Snyk scans
         if: github.event_name == 'push'
         working-directory: ./src/github.com/argoproj/argo-cd
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         run: |
-          snyk container test quay.io/argoproj/argocd:latest --org=argoproj --file=Dockerfile --severity-threshold=high
+          make snyk-container-tests
+      - uses: github/codeql-action/upload-sarif@v1
+        if: github.event_name == 'push'
+        with:
+          category: Snyk scan for Argo CD image
+          sarif_file: /tmp/argocd-image.sarif
 
       # deploy
       - run: git clone "https://$TOKEN@github.com/argoproj/argoproj-deployments"

.github/workflows/update-snyk.yaml

@@ -0,0 +1,25 @@
+name: Snyk report update
+on:
+  schedule:
+    - cron: '0 0 * * 0' # midnight every Sunday
+jobs:
+  snyk-report:
+    name: Update Snyk report in the docs directory
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build reports
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          stable_release="release-$(sed -E 's/\.[0-9]+$//g' VERSION)"
+          make snyk-report target_branch="$stable_release"
+          git config --global user.email 'ci@argoproj.com'
+          git config --global user.name 'CI'
+          git add docs/snyk/index.md
+          git add docs/snyk/*/*.html
+          git commit -m "[Bot] Update Snyk reports"
+          git push --set-upstream crenshaw-dev

Makefile

@@ -571,3 +571,15 @@ applicationset-controller:
 .PHONY: checksums
 checksums:
 	for f in ./dist/$(BIN_NAME)-*; do openssl dgst -sha256 "$$f" | awk ' { print $$2 }' > "$$f".sha256 ; done
+
+.PHONY: snyk-container-tests
+snyk-container-tests:
+	./hack/snyk-container-tests.sh
+
+.PHONY: snyk-non-container-tests
+snyk-non-container-tests:
+	./hack/snyk-non-container-tests.sh
+
+.PHONY: snyk-report
+snyk-report:
+	./hack/snyk-report.sh $(target_branch)

docs/snyk/index.md

@@ -0,0 +1,47 @@
+# Snyk Scans
+
+Every Sunday, Snyk scans are generated for Argo CD's `master` branch and the most recent patches of the three most
+recent minor releases.
+
+## Scans
+
+### master
+
+* [dependencies (golang and JavaScript)](master/argocd-test.html) — go.mod: 0 critical, 1 high, 2 medium, 0 low; ui/yarn.lock: 0 critical, 0 high, 2 medium, 0 low
+* [(image) ghcr.io/dexidp/dex:v2.32.0](master/ghcr.io_dexidp_dex:v2.32.0.html) — 0 critical, 2 high, 0 medium, 0 low
+* [(image) haproxy:2.0.29-alpine](master/haproxy:2.0.29-alpine.html) — 0 critical, 0 high, 0 medium, 0 low
+* [(image) quay.io/argoproj/argocd:latest](master/quay.io_argoproj_argocd:latest.html) — 0 critical, 0 high, 3 medium, 17 low
+* [(image) redis:7.0.4-alpine](master/redis:7.0.4-alpine.html) — 0 critical, 0 high, 0 medium, 0 low
+* [(IaC) manifests/install.yaml](master/argocd-iac-install.html)
+* [(IaC) manifests/namespace-install.yaml](master/argocd-iac-namespace-install.html)
+
+### v2.4.7
+
+* [dependencies (golang and JavaScript)](v2.4.7/argocd-test.html) — go.mod: 0 critical, 1 high, 3 medium, 0 low; ui/yarn.lock: 0 critical, 1 high, 2 medium, 0 low
+* [(image) ghcr.io/dexidp/dex:v2.30.2](v2.4.7/ghcr.io_dexidp_dex:v2.30.2.html) — 1 critical, 4 high, 0 medium, 1 low
+* [(image) haproxy:2.0.25-alpine](v2.4.7/haproxy:2.0.25-alpine.html) — 3 critical, 4 high, 0 medium, 1 low
+* [(image) quay.io/argoproj/argocd:v2.4.7](v2.4.7/quay.io_argoproj_argocd:v2.4.7.html) — 0 critical, 0 high, 3 medium, 17 low
+* [(image) redis:7.0.0-alpine](v2.4.7/redis:7.0.0-alpine.html) — 0 critical, 2 high, 0 medium, 0 low
+* [(IaC) manifests/install.yaml](v2.4.7/argocd-iac-install.html)
+* [(IaC) manifests/namespace-install.yaml](v2.4.7/argocd-iac-namespace-install.html)
+
+### v2.3.6
+
+* [dependencies (golang and JavaScript)](v2.3.6/argocd-test.html) — go.mod: 0 critical, 1 high, 3 medium, 0 low; ui/yarn.lock: 1 critical, 9 high, 25 medium, 2 low
+* [(image) ghcr.io/dexidp/dex:v2.30.2](v2.3.6/ghcr.io_dexidp_dex:v2.30.2.html) — 1 critical, 4 high, 0 medium, 1 low
+* [(image) haproxy:2.0.25-alpine](v2.3.6/haproxy:2.0.25-alpine.html) — 3 critical, 4 high, 0 medium, 1 low
+* [(image) quay.io/argoproj/argocd-applicationset:v0.4.1](v2.3.6/quay.io_argoproj_argocd-applicationset:v0.4.1.html) — 0 critical, 4 high, 38 medium, 29 low
+* [(image) quay.io/argoproj/argocd:v2.3.6](v2.3.6/quay.io_argoproj_argocd:v2.3.6.html) — 0 critical, 0 high, 4 medium, 17 low
+* [(image) redis:6.2.6-alpine](v2.3.6/redis:6.2.6-alpine.html) — 0 critical, 1 high, 0 medium, 0 low
+* [(IaC) manifests/install.yaml](v2.3.6/argocd-iac-install.html)
+* [(IaC) manifests/namespace-install.yaml](v2.3.6/argocd-iac-namespace-install.html)
+
+### v2.2.9
+
+* [dependencies (golang and JavaScript)](v2.2.9/argocd-test.html) — go.mod: 0 critical, 1 high, 3 medium, 0 low; ui/yarn.lock: 1 critical, 10 high, 33 medium, 2 low
+* [(image) ghcr.io/dexidp/dex:v2.30.2](v2.2.9/ghcr.io_dexidp_dex:v2.30.2.html) — 1 critical, 4 high, 0 medium, 1 low
+* [(image) haproxy:2.0.25-alpine](v2.2.9/haproxy:2.0.25-alpine.html) — 3 critical, 4 high, 0 medium, 1 low
+* [(image) quay.io/argoproj/argocd:v2.2.9](v2.2.9/quay.io_argoproj_argocd:v2.2.9.html) — 0 critical, 0 high, 4 medium, 25 low
+* [(image) redis:6.2.6-alpine](v2.2.9/redis:6.2.6-alpine.html) — 0 critical, 1 high, 0 medium, 0 low
+* [(IaC) manifests/install.yaml](v2.2.9/argocd-iac-install.html)
+* [(IaC) manifests/namespace-install.yaml](v2.2.9/argocd-iac-namespace-install.html)