Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Snyk scanning & monitoring #978

Merged
merged 1 commit into from
Aug 2, 2023

Conversation

ryan-wren
Copy link
Contributor

@ryan-wren ryan-wren commented Aug 1, 2023

Checklist

=========

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have checked for similar issues and haven't found anything relevant.
  • This is not a security issue (which should be reported here: https://circleci.com/security/)
  • I have read Contribution Guidelines.

Internal Checklist

  • I am requesting a review from my own team as well as the owning team
  • I have a plan in place for the monitoring of the changes that I am making (this can include new monitors, logs to be aware of, etc...)

Changes

=======

  • Added vulnerability-scan job to the CircleCI config, to run Snyk scans and monitoring

Rationale

=========

The Snyk scans should be used to discover vulnerabilities in this project.

Considerations

==============

Why you made some of the technical decisions that you made, especially if the
reasoning is not immediately obvious

Screenshots

============

Before

Image or [gif](https://giphy.com/apps/giphycapture)

After

Image or gif where change can be clearly seen

Here are some helpful tips you can follow when submitting a pull request:

  1. Fork the repository and create your branch from main.
  2. Run make build in the repository root.
  3. If you've fixed a bug or added code that should be tested, add tests!
  4. Ensure the test suite passes (make test).
  5. The --debug flag is often helpful for debugging HTTP client requests and responses.
  6. Format your code with gofmt.
  7. Make sure your code lints (make lint). Note: This requires Docker to run inside a local job.

@ryan-wren ryan-wren requested a review from a team as a code owner August 1, 2023 17:43
@ryan-wren ryan-wren mentioned this pull request Aug 1, 2023
7 tasks
@ryan-wren
Copy link
Contributor Author

The original PR for these changes is here - #974 , but I messed up doing a rebase.

@vallieres I switched the logic as suggested to upload results from the Snyk scans on the dev branch. Here is the before screenshot:
Screenshot 2023-08-01 at 13 28 43

And here is the after screenshot:
Screenshot 2023-08-01 at 13 38 11

So, the results were uploaded to Snyk for this branch as expected. I'll delete the projects that were created from this branch. And I switched the logic back to only upload results on the main branch.

Copy link

@vallieres vallieres left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@ryan-wren ryan-wren merged commit 6eab4d4 into develop Aug 2, 2023
@ryan-wren ryan-wren deleted the add-snyk-scanning-and-monitoring branch August 2, 2023 17:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants