Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEC-6985 Add Snyk Scans in CircleCI (NPM) #533

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

pd-snyk-integration
Copy link

@pd-snyk-integration pd-snyk-integration commented Jul 26, 2024

Context

This PR will enable Snyk Open Source scans in CircleCI.

Changes Include:

  1. Updating the CircleCI config.yml to add the PagerDuty Snyk orb, and adding the Job to run that scan

Engineering Team Code Owners Should Test, Validate, and Merge

Please update as needed and merge these PRs when you feel comfortable to do so.
We are asking the teams that own each repository to carefully test and merge these changes so they can monitor for any resulting issues, as they are more familiar with the code and deploy process.

Checklist for Team Code Owners

  • Ensure that all builds are successful.
  • Check review for any comments/addendums from Product Security that might need to be manually addressed.
  • Approve and MERGE the PR when ready!

Checklist for Product Security

Snyk WebUI

  • The Snyk WebUI has been reviewed to ensure the repo is now showing up as expected
  • There are no duplicate findings in the WebUI (ex: there's already a Github integration for non-Elixir dependencies)

CircleCI

  • Ensure all builds still complete
  • The Snyk scan is not failing due to an error with the scan
  • The Snyk scan is either passing or failing due to vulnerabilities
  • The Snyk scan is detecting the expected package manager files (based on reviewing what's in the repo)

@megg-pd megg-pd marked this pull request as ready for review August 13, 2024 22:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants