Installing SNYK mutation tool for Static Analysis

[fdounis]

PR integrates Snyk into our CI/CD pipeline as a static analysis tool for identifying known vulnerabilities in our dependencies. Snyk scans the project’s node_modules for any security issues, giving us insights into outdated or vulnerable packages and providing remediation suggestions.

Why Snyk?

• Security: Snyk provides a comprehensive vulnerability database that enables early detection of risks in project dependencies.
• Automation: By running Snyk in GitHub Actions, we automate security checks on every push or pull request to the main branch, improving our codebase’s resilience against known threats.
• Visibility: Snyk gives actionable insights into vulnerability severity (High, Medium, Low), with guidance on fixing the issues detected.

Workflow Details:

The Snyk Vulnerability Scan workflow is triggered on each push to main and for every pull request targeting main.
Snyk will authenticate using a SNYK_TOKEN stored in GitHub Secrets, ensuring secure access.

The scan output provides a detailed list of vulnerabilities and potential fixes, allowing the team to prioritize remediation based on severity.

Steps Included:

1. Installed Snyk using npm and added it as a dev dependency.
2. Created a GitHub Actions workflow (snyk-analysis.yml) to run Snyk scans in our CI/CD pipeline.

3. Configured Snyk to authenticate via a GitHub secret token and to scan all project dependencies.

Output Details:

Snyk will generate a report listing detected vulnerabilities with links to additional information on each issue.

Each finding includes:

• Severity: High, Medium, Low
• Dependency Path: The specific path and version of the vulnerable dependency
• Fix Recommendation: Any available patches or upgrades to address the vulnerability