File size: 2,433 Bytes
b585c7f |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 |
name: Snyk Security Vulnerability Scan
on:
workflow_dispatch:
pull_request:
push:
tags:
- 'v[0-9]+.[0-9]+.[0-9]+'
branches:
- main
jobs:
snyk_scan_test:
if: ${{ github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- uses: snyk/actions/setup@master
- uses: actions/setup-python@v4
with:
python-version: '3.10'
- name: Check changed Deps files
uses: tj-actions/changed-files@v35
id: changed-files
with:
files: | # This will match all the files with below patterns
requirements.txt
- name: Scan python dependencies
if: contains(steps.changed-files.outputs.all_changed_and_modified_files, 'requirements.txt')
env:
SNYK_TOKEN: '${{ secrets.SNYK_TOKEN }}'
run: |
head -n 41 requirements.txt > temp-requirements.txt #remove test deps
python3.10 -m pip install -r temp-requirements.txt
snyk test \
-d \
--file=temp-requirements.txt \
--package-manager=pip \
--command=python3.10 \
--skip-unresolved \
--severity-threshold=high
snyk_scan_monitor:
if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch'}}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- uses: snyk/actions/setup@master
- uses: actions/setup-python@v4
with:
python-version: '3.10'
- name: Extract github branch/tag name
shell: bash
run: echo "ref=$(echo ${GITHUB_REF##*/})" >> $GITHUB_OUTPUT
id: extract_ref
- name: Monitor python dependencies
env:
SNYK_TOKEN: '${{ secrets.SNYK_TOKEN }}'
run: |
head -n 41 requirements.txt > temp-requirements.txt #remove test deps
python3.10 -m pip install -r temp-requirements.txt
snyk monitor \
-d \
--file=temp-requirements.txt \
--command=python3.10 \
--package-manager=pip \
--skip-unresolved \
--remote-repo-url=h2ogpt/${{ steps.extract_ref.outputs.ref }} \
--org=h2o-gpt \
--project-name=H2O-GPT/h2ogpt/${{ steps.extract_ref.outputs.ref }}/requirements.txt
|