Integrating Snyk Analysis Tool (attempt 2)

[njouud]

Pull request for integrating snyk, a static security analysis tool, with the codebase. Snyk scans the dependencies of the codebase for vulnerabilities (security risks) and provides code security analysis on the app.snyk.io website.

This is a second attempt, the first being pull request #88 which failed deployment, could have been due to the earlier commits having edited gitignore and commented out package.json.

1. Process:

• Installed the tool withnpm install -g snyk, then made a snyk account with snyk auth to be able to run tests, then finally snyk test to run the test scan, where the output is given in the terminal (screenshots below).
• Copied the Snyk API key and stored it in github secrets under Actions of this repository
• Created the below files

2. Changed files:
install/package.json: manually added the tool in dev dependencies with "snyk": "^1.1294.0" to address NPM install error.
.install/snyk: created a new file to add the dependencies snyk should ignore (with specifying the reason for ignoring) (has to be in the same directory as package.json, so added it under install).
.github/workflows/snyk.yaml: file to integrate Snyk in the github actions workflow, specifying the severity threshold of vulnerability risks to test (high vulnerability) and the frequency of running tests (every PR).

3. Terminal output screenshots (after resolving vulnerabilities by updating):

[coveralls]

Pull Request Test Coverage Report for Build 11635732097

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.005%) to 82.372%

---

Totals
Change from base Build 11634384123:	0.005%
Covered Lines:	22369
Relevant Lines:	25711

---

💛 - Coveralls

[Procos12]

Looks good
Snyk yaml and related package files are in order
Ready to merge and test