From 434a62ab5353b7f4363d0972ed10585cc637411f Mon Sep 17 00:00:00 2001 From: Akanksha Trehun Date: Fri, 6 Nov 2026 10:12:36 +0530 Subject: [PATCH 1/2] ci(snyk): record main's tested dependencies with snyk monitor On pushes to main, the weekly run and manual runs, the Snyk workflow now records what it tested as the Snyk project reframe-oss/reframe-ci, so the dashboard tracks those versions and Snyk alerts on new advisories for them. Pull requests are only tested. Docs list the checks main now requires. --- .github/workflows/snyk.yml | 13 +++++++++++++ docs/SECURITY-PIPELINE.md | 10 +++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index dd36c0b83..d1a394cb8 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -88,6 +88,19 @@ jobs: # is clean. args: --severity-threshold=high --file=package-lock.json + # Records what was just tested as a Snyk project, so the Snyk dashboard + # tracks the versions CI tests (the GitHub integration's own project + # reads package.json ranges) and alerts when a new advisory affects + # them. main only: pull requests are tested, never recorded. + - name: Record the tested dependencies in Snyk (main) + if: (success() || failure()) && github.event_name != 'pull_request' + uses: snyk/actions/node@master + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + command: monitor + args: --file=package-lock.json --project-name=reframe-oss/reframe-ci + - name: Alert on High/Critical Snyk Findings if: failure() && steps.snyk.outcome == 'failure' && (github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'workflow_dispatch') uses: actions/github-script@v9 diff --git a/docs/SECURITY-PIPELINE.md b/docs/SECURITY-PIPELINE.md index 8c1c2642e..f32a5375d 100644 --- a/docs/SECURITY-PIPELINE.md +++ b/docs/SECURITY-PIPELINE.md @@ -72,7 +72,15 @@ repository, `security/snyk` and `license/snyk`, and `snyk.yml` runs the CLI (`snyk test`, high and critical only) on pushes to main, on same-repo pull requests and weekly. Snyk can't read `bun.lock`, so that job tests a `package-lock.json` generated from `package.json`; the bun.lock policy above -is the exact check. +is the exact check. On main and the weekly run it also records what it +tested (`snyk monitor`) as the Snyk project `reframe-oss/reframe-ci`, so the +dashboard tracks those versions and Snyk alerts when a new advisory affects +them. + +Required on `main` (the `main-protection` ruleset): `build`, `Dependency +scan`, `Dependency policy (bun.lock)`, `Secret scan (gitleaks)`, `Workflow +lint (actionlint)` and `security/snyk`. `Dependency scan` is skipped on pull +requests from forks (no secrets there), which counts as passing. `.snyk` holds the policy: open-source ignores (none) and the paths Snyk Code skips (test-only code). From 2b6cf157830d58e6e481acf52eed07cfd40b67c3 Mon Sep 17 00:00:00 2001 From: Akanksha Trehun Date: Fri, 6 Nov 2026 19:26:01 +0530 Subject: [PATCH 2/2] ci(snyk): pin the Snyk CLI image by digest snyk/actions/node@master ran with SNYK_TOKEN from whatever was last pushed to that branch. Pinning the action's commit would not be enough: the action is a wrapper that runs the floating snyk/snyk:node image. Both steps now run that image by digest, with the arguments and environment the action's v1.0.0 action.yml passes. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/snyk.yml | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index d1a394cb8..960a3e609 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -77,16 +77,25 @@ jobs: - name: Generate a lockfile Snyk can parse run: npm install --package-lock-only --ignore-scripts --legacy-peer-deps + # The Snyk CLI image, pinned by digest. snyk/actions/node is only a + # wrapper that runs the floating snyk/snyk:node tag, so pinning the + # action's commit would still run whatever image was pushed last, with + # SNYK_TOKEN. These steps pass what that action passes (its v1.0.0 + # action.yml). To update: take the digest of snyk/snyk:node from Docker + # Hub, check the release notes, and change both steps together. - name: Run Snyk id: snyk - uses: snyk/actions/node@master + uses: docker://snyk/snyk:node@sha256:71629f3cc12e98b9693cd59f60e81ce880745ced646e2f7cb784fa00281d0b71 env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + FORCE_COLOR: 2 + SNYK_INTEGRATION_NAME: GITHUB_ACTIONS + SNYK_INTEGRATION_VERSION: node with: # High and critical only, so the first run is actionable rather than # a wall of low-severity transitive noise. Lower it once the backlog # is clean. - args: --severity-threshold=high --file=package-lock.json + args: snyk test --severity-threshold=high --file=package-lock.json # Records what was just tested as a Snyk project, so the Snyk dashboard # tracks the versions CI tests (the GitHub integration's own project @@ -94,12 +103,14 @@ jobs: # them. main only: pull requests are tested, never recorded. - name: Record the tested dependencies in Snyk (main) if: (success() || failure()) && github.event_name != 'pull_request' - uses: snyk/actions/node@master + uses: docker://snyk/snyk:node@sha256:71629f3cc12e98b9693cd59f60e81ce880745ced646e2f7cb784fa00281d0b71 env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + FORCE_COLOR: 2 + SNYK_INTEGRATION_NAME: GITHUB_ACTIONS + SNYK_INTEGRATION_VERSION: node with: - command: monitor - args: --file=package-lock.json --project-name=reframe-oss/reframe-ci + args: snyk monitor --file=package-lock.json --project-name=reframe-oss/reframe-ci - name: Alert on High/Critical Snyk Findings if: failure() && steps.snyk.outcome == 'failure' && (github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'workflow_dispatch')