argo-cd/.github/workflows/update-snyk.yaml at c91068c9f431009ddb69ffe189366cb3d943b117 · argoproj/argo-cd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: Snyk report update
on:
  workflow_dispatch: {}
  schedule:
    - cron: '0 0 * * 0' # midnight every Sunday

permissions:
  contents: read

env:
  # a workaround to disable harden runner
  STEP_SECURITY_HARDEN_RUNNER: ${{ vars.disable_harden_runner }}

jobs:
  snyk-report:
    permissions:
      contents: read
    if: github.repository == 'argoproj/argo-cd'
    name: Generate Snyk Report
    runs-on: ubuntu-24.04
    steps:
      - name: Harden the runner (Audit all outbound calls)
        if: ${{ vars.disable_harden_runner != 'true' }}
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: block
          # The entries are grouped according to their platforms
          # there is a lot of requests snyk does when checking docker images:
          # (d2glxqk2uabbnd|d5l0dvt14r5h8).cloudfront.net are part of aws ecr
          # api.snapcraft.io is for ubuntu snap applications
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            pkg-containers.githubusercontent.com:443
            api.snyk.io:443
            downloads.snyk.io:443
            registry.npmjs.org:443
            proxy.golang.org:443
            sum.golang.org:443
            storage.googleapis.com:443
            quay.io:443
            cdn01.quay.io:443
            ghcr.io:443
            public.ecr.aws:443
            d2glxqk2uabbnd.cloudfront.net:443
            d5l0dvt14r5h8.cloudfront.net:443
            registry-1.docker.io:443
            api.snapcraft.io:443
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Build reports
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          make snyk-report
      - name: Upload Report Artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: snyk-report
          path: docs/snyk
          retention-days: 1  # minimum supported
          if-no-files-found: error
          overwrite: true

  make-report-pr:
    needs: snyk-report
    permissions:
      contents: write
      pull-requests: write
    if: github.repository == 'argoproj/argo-cd'
    name: Update Snyk report in the docs directory
    runs-on: ubuntu-24.04
    steps:
      - name: Harden the runner (Audit all outbound calls)
        if: ${{ vars.disable_harden_runner != 'true' }}
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Clean old report
        run: |
          rm -rvf docs/snyk
      - name: Download Report Artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: snyk-report
          path: docs/snyk
      - name: Make pr
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          pr_branch="snyk-update-$(echo $RANDOM | md5sum | head -c 20)"
          git checkout -b "$pr_branch"
          git config --global user.email 'ci@argoproj.com'
          git config --global user.name 'CI'
          git add docs/snyk
          git commit -m "[Bot] docs: Update Snyk reports" --signoff
          git push --set-upstream origin "$pr_branch"
          gh pr create -B master -H "$pr_branch" --title '[Bot] docs: Update Snyk report' --body ''