Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CircleCi3-binary-nodeJS.yml #43

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions CircleCI/CircleCi3-binary-nodeJS.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# A nodeJS circleCI script that leverages the Snyk CLI tool to conduct SCA, Code, Container, and IaC scans. HTML artifacts are generated for all the scans using snyk-to-html.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add a few more bits of info to the top of this file:

... The top of the file should contain helpful links to the documentation of the CI/CD system itself and a note on what the filename in the end should be. In the GH Actions example, the filename really should be .github/workflows/snyk.yml, for example.

version: 2.1

jobs:
build:
docker:
- image: circleci/node:latest
steps:
- checkout
- run: npm install --force
- run: npm update
- run: | #install Snyk CLI tool and snyk-to-html + authenticate into Snyk
curl https://static.snyk.io/cli/latest/snyk-linux -o snyk
chmod +x ./snyk
curl -L https://github.com/snyk/snyk-to-html/releases/download/v2.3.1/snyk-to-html-linux -o snyk-to-html
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we use latest instead of 2.3.1 here?

chmod +x ./snyk-to-html
./snyk auth $SNYK_TOKEN

# SCA scan with severity threshold set to high
- run: ./snyk test --severity-threshold=critical --json | ./snyk-to-html -o sca_results.html
- store_artifacts:
path: sca_results.html
destination: sca_results.html

# SAST code scan
- run: ./snyk code test --json | ./snyk-to-html -o code_results.html
- store_artifacts:
path: code_results.html
destination: code_results.html

# Container image scan - replace amitsnyk/snyk-juice-shop:latest with your registry/image_name:tag.
- run: ./snyk container test amitsnyk/snyk-juice-shop:latest --json | ./snyk-to-html -o container_results.html
- store_artifacts: #store container json output generated by Snyk
path: container_results.html
destination: container_results.html

# IaC scan
- run: ./snyk iac test --json | ./snyk-to-html -o iac_results.html
- store_artifacts: #store iac json output generated by Snyk
path: iac_results.html
destination: iac_results.html
workflows: null