Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Integrate Scala projects with Snyk #33

Merged
merged 2 commits into from
Mar 20, 2024

Conversation

gu-dependency-graph-integrator[bot]
Copy link
Contributor

What does this change?

This PR integrates your repository with Snyk, to track its dependencies, in line with our recommendations.

Why?

If a repository is in production, we need to track its third party dependencies for vulnerabilities. DevX have detected that your repo contains at least one language that is not supported by Dependabot. As a result, we have raised this PR on your behalf to add it to Snyk.

How has it been verified?

We have tested this action against a combination of TypeScript, Scala, Go, and Python repositories. If your repository contains other languages not included here, integration may not work the way you expect it to.

What do I need to do?

  • Replace the SNYK_ORG variable with the org name that your team already uses (you should have other repos integrated with Snyk. If you can’t find any, reach out to DevX). Examples are guardian-devtools and guardian-dotcom-n2y
  • The Snyk job should run automatically on every commit to this branch. Click through on the Snyk status check see the logs of the latest run on this PR, and verify it has generated one project per dependency manifest (except pnpm and deno). Examples of dependency manifests are a build.sbt, or a package-lock.json, essentially, any file that lists the dependencies of your project.
  • When you are happy the action works, remove the branch name integrate-snyk-19502f22c5c92630trigger from the snyk.yml (aka delete line 6), approve, and merge.

Copy link
Contributor

@codingWithRach codingWithRach left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automatically created file was not needed, but needed to update existing file to rename master to main

@codingWithRach codingWithRach merged commit 40977f8 into main Mar 20, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant