This repository is in maintenance mode, no new features are being developed. Bug & security fixes will continue to be delivered. Open source contributions are welcome for small features & fixes (no breaking changes)

snyk-prevent-gh-commit-status

Little module to POST commit status of a PR the result of snyk-delta executed in the CI.

Installation

• npm i -g snyk-prevent-gh-commit-status
  OR
• Don't install anything and use npx (if you're in Node ecosystem already)
  OR
• Download release binaries for your system

Usage

1. In your CI pipeline, run the SNYK CLI or Orb or plugin with the option to export the json result into a file (--json-file-output=snykTestResults.json).

2. Call snyk-prevent-gh-commit-status module or binary with the following arguments:

The link to CI Job is strongly recommended as it guides developers to the result set in the CI job. Enhancements are coming up to improve visibility and clarity on the issues findings.

snyk-prevent-gh-commit-status-linux
 /path/to/snykTestResults.json
 <GITHUB_TOKEN>
 <GH_ORG_NAME>
 <GH_REPO_NAME>
 <GH_COMMIT_SHA1>
 <GH_PR_NUMBER>
 <LINK_TO_CI_JOB - optional>
 <keepHistory - optional - if set the tool will post a new comment at each run otherwise it will update the existing comment>
 <failOn value - optional - if set, the commit status fails only if there are issues fixable by upgrade or patch or both.

Snyk CLI in bash

> snyk test --json-file-output=snykTestResults.json || true
> ./snyk-prevent-gh-commit-status-linux
    ./snykTestResults.json
    <GITHUB_TOKEN>
    <GH_ORG_NAME>
    <GH_REPO_NAME>
    <CIRCLE_SHA1>
    <GH_PR_NUMBER>
    <LINK_TO_CI_JOB - optional>
    <keepHistory - optional>

Snyk CLI in bash using npx

> snyk test --json-file-output=snykTestResults.json || true
> npx snyk-prevent-gh-commit-status
    ./snykTestResults.json
    <GITHUB_TOKEN>
    <GH_ORG_NAME>
    <GH_REPO_NAME>
    <CIRCLE_SHA1>
    <GH_PR_NUMBER>
    <LINK_TO_CI_JOB - optional>
    <keepHistory - optional>

Circle CI

Example in CircleCI using an Orb for a Go Modules project example PR

    - checkout
    - run: go test -v
    - snyk/scan:
        fail-on-issues: false
        monitor-on-build: false
        token-variable: SNYK_TOKEN
        additional-arguments: --json-file-output=snykTestResults.json
    - run: ./snyk-prevent-gh-commit-status-linux ./snykTestResults.json ${GITHUB_TOKEN} ${CIRCLE_PROJECT_USERNAME} ${CIRCLE_PROJECT_REPONAME} ${CIRCLE_SHA1} ${CIRCLE_PULL_REQUEST} ${CIRCLE_BUILD_URL}

CIRCLE_PULL_REQUEST will be a randomly selected PR if you have more than one. Be careful selecting the value

More CI examples soon

Point to GHE

export GH_API='https://ghe-hostname/apiendpoint'

Additional option to enable snykDelta Debug

export SNYK_DEBUG=true
./snyk-prevent-gh-commit-status-linux
    ./snykTestResults.json
    <GITHUB_TOKEN>
    <GH_ORG_NAME>
    <GH_REPO_NAME>
    <CIRCLE_SHA1>
    <GH_PR_NUMBER>
    <LINK_TO_CI_JOB - optional>
    <keepHistory - optional>
    <setPassIfNoBaselineFlag - optional>

No baseline

In case of an unmonitored project, it is possible to force the snyk-delta result so snyk-prevent-gh-commit-status will not fail. If some vulnerabilities are found comment listing the vulnerabilities will still be the post on the PR.

Fail on

If set, the commit status fails only if there are issues fixable by upgrade or patch or both. See Snyk CLI documentation and Snyk-delta README usage section.

Debug

use DEBUG=snyk* to enable snyk-prevent-gh-commit-status

DEBUG=snyk* ./snyk-prevent-gh-commit-status-linux
    ./snykTestResults.json
    <GITHUB_TOKEN>
    <GH_ORG_NAME>
    <GH_REPO_NAME>
    <CIRCLE_SHA1>
    <GH_PR_NUMBER>
    <LINK_TO_CI_JOB - optional>
    <keepHistory - optional>
    <setPassIfNoBaselineFlag - optional>

or to enable both snykDelta and snyk-prevent-gh-commit-status debug

export SNYK_DEBUG=true
DEBUG=snyk* ./snyk-prevent-gh-commit-status-linux
    ./snykTestResults.json
    <GITHUB_TOKEN>
    <GH_ORG_NAME>
    <GH_REPO_NAME>
    <CIRCLE_SHA1>
    <GH_PR_NUMBER>
    <LINK_TO_CI_JOB - optional>
    <keepHistory - optional>
    <setPassIfNoBaselineFlag - optional>