From aa0c660a0c5193ed50b4b5bffdbeb707ab182377 Mon Sep 17 00:00:00 2001 From: Madhu Rajanna Date: Wed, 15 Nov 2023 09:45:45 +0100 Subject: [PATCH] ci: add snyk scanning adding snyk github action to run when a PR is merged to the release branch or when a new release is done. Run snyk weekly on the devel branch. This will help us to track the security scanning results and fix if anything is required and also it serves as a placeholder for security scanning result for a while. Signed-off-by: Madhu Rajanna --- .github/workflows/snyk.yaml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/snyk.yaml diff --git a/.github/workflows/snyk.yaml b/.github/workflows/snyk.yaml new file mode 100644 index 00000000000..40b05e089e7 --- /dev/null +++ b/.github/workflows/snyk.yaml @@ -0,0 +1,30 @@ +--- +name: Security scanning +# yamllint disable-line rule:truthy +on: + schedule: + # Run weekly on Monday + - cron: '0 0 * * 1' + push: + tags: + - v* + branches: + - release-* + +permissions: + contents: read + +jobs: + security: + if: github.repository == 'ceph/ceph-csi' + runs-on: ubuntu-latest + steps: + - name: checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: run Snyk to check for code vulnerabilities + uses: snyk/actions/golang@master + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}