Add Snyk scanning & monitoring

.circleci/config.yml

@@ -2,6 +2,7 @@ version: 2.1
 
 orbs:
   shellcheck: circleci/[email protected]
+  snyk: snyk/[email protected]
   windows: circleci/[email protected]
 
 executors:
@@ -304,6 +305,46 @@ jobs:
           command: choco push circleci-cli.nupkg --source https://chocolatey.org/ --apikey $env:CHOCO_API_KEY
           working_directory: chocolatey
 
+  vulnerability-scan:
+    executor: go
+    steps:
+      - checkout
+      - run:
+          name: Setup Scanning
+          command: |
+              git config --global url."https://$GITHUB_USER:[email protected]/circleci/".insteadOf "https://github.com/circleci/"
+      - when:
+          condition:
+              or:
+                - equal: [ main, << pipeline.git.branch >> ]
+          steps:
+              - run:
+                  name: Launching Snyk Orb Scanning
+                  command: echo "Running snyk/scan on main; uploading the results"
+              - run:
+                  name: Cleanup RemoteRepoURL
+                  command: echo 'export REMOTE_REPO_URL="${CIRCLE_REPOSITORY_URL%".git"}"' >> "$BASH_ENV"
+              - snyk/scan:
+                  organization: "circleci-public"
+                  fail-on-issues: true
+                  severity-threshold: high
+                  monitor-on-build: true
+                  additional-arguments: "--all-projects --remote-repo-url=${REMOTE_REPO_URL} -d"
+      - unless:
+          condition:
+              or:
+                - equal: [ main, << pipeline.git.branch >> ]
+          steps:
+              - run:
+                  name: Launching Snyk Orb Scanning
+                  command: echo "Running snyk/scan on branch; not uploading the results"
+              - snyk/scan:
+                  organization: "circleci-public"
+                  fail-on-issues: true
+                  severity-threshold: high
+                  monitor-on-build: false
+                  additional-arguments: "--all-projects -d"
+
 workflows:
   ci:
     jobs:
@@ -317,6 +358,8 @@ workflows:
       - test_windows
       - coverage
       - lint
+      - vulnerability-scan:
+          context: org-global-employees
       - deploy-test
       - docs:
           requires: