chore: prodsec security scanning [IDE-158] #5
Conversation
bastiandoetsch
left a comment
bastiandoetsch
left a comment
There was a problem hiding this comment.
There's also a prodsec reusable action: https://github.com/snyk/prodsec-orb/tree/main/.github/workflows. It's not as complete as circleci though. But it is worth considering building everything in circleci anyway.
.circleci/config.yml
Outdated
| orbs: | ||
| snyk: snyk/snyk@1.2.3 | ||
| prodsec: snyk/prodsec-orb@1.0 | ||
| prodsec: snyk/prodsec-orb@1.1 |
There was a problem hiding this comment.
Better to use @1 instead of the minor release. The minor release had problems in some of our repos.
teodora-sandu
force-pushed
the
chore/prodsec-security-scanning
branch
from
8dc5ec7 to
23a2061
Compare
I did not know that but my understanding is that this orb is going to be the recommended way of doing security scans soon: https://snyksec.atlassian.net/wiki/spaces/PRODSEC/pages/1752629272?atlOrigin=eyJpIjoiNDkzNmZiZDg3MGQ0NGU3ZTk2ZDNjNzNmM2ZlZGE3OTIiLCJwIjoiY29uZmx1ZW5jZS1jaGF0cy1pbnQifQ |
Before we can open source the repo we need to update the security scanning quality gates to use the
prodsec-orb.The only actual change is that we only monitor on
mainand only gate on the branch, which the orb takes care of for us.