Skip to content

chore(codeql): setup snyk #154

chore(codeql): setup snyk

chore(codeql): setup snyk #154

Workflow file for this run

name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
types: [opened, synchronize, reopened]
schedule:
- cron: 0 0 * * 0
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
test-node:
strategy:
matrix:
node-version: [18, 20, 22]
name: test (node-${{ matrix.node-version }})
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v3
- uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
cache: pnpm
- run: pnpm build && pnpm test:node
test-all:
name: test (deno, bun)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v3
- uses: actions/setup-node@v4
with:
node-version: 20
cache: pnpm
- uses: denoland/setup-deno@v1
- uses: oven-sh/setup-bun@v1
with:
bun-version: latest
- run: pnpm lint && [ -z "$(git status --porcelain)" ]
- run: pnpm test:deno && pnpm test:bun
codeql-others:
name: codeql (devskim, snyk)
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v3
- uses: actions/setup-node@v4
with:
node-version: 20
cache: pnpm
- uses: microsoft/devskim-action@v1
with:
directory-to-scan: src
- run: node scripts/normalize-sarif.js devskim-results.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: devskim-results.sarif
category: devskim
- run: pnpm install -g snyk
- run: snyk auth ${{ secrets.SNYK_TOKEN }}
- run: snyk monitor --all-projects
- run: snyk code test $(realpath src) --sarif > snyk-results.sarif
- run: node scripts/normalize-sarif.js snyk-results.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: snyk-results.sarif
category: snyk