-
Notifications
You must be signed in to change notification settings - Fork 25
56 lines (46 loc) · 1.74 KB
/
snyk-schedule.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
name: Snyk Schedule
# Run every sunday at 2:14.
on:
schedule:
- cron: '14 2 * * 6'
permissions:
contents: read
jobs:
security:
runs-on: ubuntu-latest
strategy:
matrix:
requirements: [misc, analysis, coverage]
steps:
- uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
- name: Set up Python
uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435
with:
python-version: '3.10'
- name: Set up Node.js
uses: actions/setup-node@v3
with:
node-version: 18
- uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0
with:
path: ~/.cache/pip
key: snyk-pip-${{ hashFiles('**/.*-requirements.txt') }}
restore-keys: snyk-pip-
- name: Upgrade Pip
run: pip3 install --upgrade pip
- name: Install requirements
run: python3 -m pip install -r misc/.${{matrix.requirements}}-requirements.txt
- name: Install Snyk
run: npm install -g snyk
- name: Run Snyk
continue-on-error: true # To make sure that SARIF upload gets called
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
FORCE_COLOR: 2
SNYK_INTEGRATION_NAME: GITHUB_ACTIONS
SNYK_INTEGRATION_VERSION: python
run: snyk test --project-name=vermin --package-manager=pip --file=misc/.${{matrix.requirements}}-requirements.txt --command=python3 --sarif-file-output=snyk-${{matrix.requirements}}.sarif --show-vulnerable-paths=all --print-deps
- name: Upload result to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@67a35a08586135a9573f4327e904ecbf517a882d
with:
sarif_file: snyk-${{matrix.requirements}}.sarif