Skip to content

Commit abec074

Browse files
garethrgarethr
committed
Document the new setup action
1 parent 5450027 commit abec074

File tree

3 files changed

+113
-8
lines changed

3 files changed

+113
-8
lines changed

‎README.md‎

Lines changed: 34 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ you are using. We currently support:
2020
* [Ruby](ruby)
2121
* [Scala](scala)
2222
* [Docker](docker)
23+
* [Setup](setup)
2324

2425
Here's an example of using one of the Actions, in this case to test a Node.js project:
2526

@@ -60,11 +61,37 @@ jobs:
6061
6162
See the individual Actions linked above for per-language instructions.
6263
63-
Note: GitHub Actions will not pass on secrets set in the repository to forks being used in pull requests, and so the Snyk actions that require the token will fail to run.
64+
Note that GitHub Actions will not pass on secrets set in the repository to forks being used in pull requests, and so the Snyk actions that require the token will fail to run.
6465
65-
## Getting your Snyk token
6666
67-
The Actions example above refer to a Snyk API token:
67+
### Bring your own development environment
68+
69+
The per-language Actions automatically install all the required development tools for Snyk to determine the correct dependencies and hence vulnerabilities from different language environments. If you have a workflow where you already have those installed then you can instead use the `snyk/actions/setup` Action to just install Snyk
70+
71+
```yaml
72+
name: Snyk example
73+
on: push
74+
jobs:
75+
security:
76+
runs-on: ubuntu-latest
77+
steps:
78+
- uses: actions/checkout@master
79+
- uses: snyk/actions/setup@master
80+
- uses: actions/setup-go@v1
81+
with:
82+
go-version: "1.13"
83+
- name: Snyk monitor
84+
run: snyk test
85+
env:
86+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
87+
```
88+
89+
The example here uses `actions/setup-go` would you would need to select the right actions to install the relevant development requirements for your project. If you are already using the same pipeline to build and test your application you're likely already doing so.
90+
91+
92+
### Getting your Snyk token
93+
94+
The Actions example above refer to a Snyk API token:
6895

6996
```yaml
7097
env:
@@ -73,10 +100,12 @@ env:
73100

74101
Every Snyk account has this token, and you can find it in one of two ways:
75102
1. If you're using the [Snyk CLI](https://support.snyk.io/hc/en-us/articles/360003812458-Getting-started-with-the-CLI) you can retrieve it by running `snyk config get api`.
76-
2. In the UI, go to your account's general settings page (https://app.snyk.io/account) and retrieve the API token, as shown in the following [Revoking and regenerating Snyk API tokens](https://support.snyk.io/hc/en-us/articles/360004008278-Revoking-and-regenerating-Snyk-API-tokens).
103+
2. In the UI, go to your Snyk account's [settings page](https://app.snyk.io/account) and retrieve the API token, as shown in the following [Revoking and regenerating Snyk API tokens](https://support.snyk.io/hc/en-us/articles/360004008278-Revoking-and-regenerating-Snyk-API-tokens).
104+
77105

106+
### Continuing on error
78107

79-
Note: The above examples will halt the action when issues are found. If you want to ensure the action continues, even if Snyk finds issues, then [conmtinue-on-error]https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepscontinue-on-error will need to be set.
108+
The above examples will fail the workflow when issues are found. If you want to ensure the Action continues, even if Snyk finds vulnerabilities, then [continue-on-error](https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepscontinue-on-error) can be used..
80109

81110
```yaml
82111
name: Example workflow using Snyk with continue on error
@@ -91,7 +120,4 @@ jobs:
91120
continue-on-error: true
92121
env:
93122
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
94-
with:
95-
command: monitor
96123
```
97-

‎setup/README.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Snyk Setup Action
2+
3+
A [GitHub Action](https://github.com/features/actions) for installing [Snyk](https://snyk.io) to check for
4+
vulnerabilities.
5+
6+
You can use the Action as follows:
7+
8+
```yaml
9+
name: Snyk example
10+
on: push
11+
jobs:
12+
security:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@master
16+
- uses: snyk/actions/setup@master
17+
- uses: actions/setup-go@v1
18+
with:
19+
go-version: "1.13"
20+
- name: Snyk monitor
21+
run: snyk test
22+
env:
23+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
24+
```
25+
26+
When using the Setup Action you are responsible for setting up the development environment required to run Snyk.
27+
In this case this is a Go project so `actions/setup-go` was used, but this would be specific to your project. The [language and frameworks guides](https://docs.github.com/en/actions/language-and-framework-guides) are a good starting point.
28+
29+
The Snyk Setup Action has properties which are passed to the underlying image. These are
30+
passed to the action using `with`.
31+
32+
| Property | Default | Description |
33+
| --- | --- | --- |
34+
| snyk-version | latest | Install a specific version of Snyj |
35+
36+
The Action also has outputs:
37+
38+
| Property | Default | Description |
39+
| --- | --- | --- |
40+
| version | | The full version of the Snyk CLI installed |
41+
42+
For example, you can choose to install a specific version of Snyk. The installed version can be
43+
grabbed from the output:
44+
45+
```yaml
46+
name: Snyk example
47+
on: push
48+
jobs:
49+
security:
50+
runs-on: ubuntu-latest
51+
steps:
52+
- uses: actions/checkout@master
53+
- uses: snyk/actions/setup@master
54+
id: snyk
55+
with:
56+
snyk-version: v1.391.0
57+
- uses: actions/setup-go@v1
58+
with:
59+
go-version: "1.13"
60+
- name: Snyk version
61+
run: echo "${{ steps.snyk.outputs.version }}"
62+
- name: Snyk monitor
63+
run: snyk monitor
64+
env:
65+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
66+
```

‎setup/setup_snyk.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,19 @@
11
#!/bin/bash
22
set -e
33

4+
# This script takes two positional arguments. The first is the version of Snyk to install.
5+
# This can be a standard version (ie. v1.390.0) or it can be latest, in which case the
6+
# latest released version will be used.
7+
#
8+
# The second argument is the platform, in the format used by the `runner.os` context variable
9+
# in GitHub Actions. Note that this script does not currently support Windows based environments.
10+
#
11+
# As an example, the following would install the latest version of Snyk for GitHub Actions for
12+
# a Linux runner:
13+
#
14+
# ./snyk-setup.sh latest Linux
15+
#
16+
417
die () {
518
echo >&2 "$@"
619
exit 1

0 commit comments

Comments
 (0)