Integrating Snyk Security Analysis Tool into Github

[Hakaabi]

In this Pull Request I integrated the Snyk security analysis tool into our CI pipeline to automate vulnerability detection on all pull requests on our branch ‘f24’. I also modified the GitHub Actions workflow to automate the Snyk test process on every pull request.

I installed snyk tool using the command 'npm install -g snyk' and then I made these following modifications to ensure its integration:

Authentication

1. Created Snyk account:
   Using the command 'snyk auth' I navigated to 'https://app.snyk.io/account' and created an account linked to my github account and connected our repository to the Snyk account for automated vulnerability scanning.

2. Updated GitHub actions workflow:
   Went to setting and added a repository secret 'SNYK_KEY' to authenticate Snyk in our GitHub Actions workflow.

Files Added

1. ./install/.snyk
   I modified the ignore file to include entries for low-risk vulnerabilities that do not impact our current usage and each vulnerability entry includes a reason for ignoring and an expiration date to revisit the assessment as dependencies evolve.

2. .github/workflows/snyk.yaml
   I configured Snyk to run security checks on each pull request targeting the f24 branch and set the checks to flag high and critical severity vulnerabilities, using the 'npx snyk test --severity-threshold=high command'.

Files modified

1. ./install/package.json
   I added snyk version 1.1294.0 to the development dependencies and I updated body-parser from 1.20.2 to 1.20.3 to address an Asymmetric Resource Consumption (Amplification) vulnerability and upgraded express from 4.19.2 to 4.20.0 to fix a related vulnerability.

Workflow Execution and Testing
I ran the Snyk Test GitHub Action workflow to validate the integration and ensure dependencies are scanned within the ./install directory and I manually tested the Snyk configuration locally to confirm that all vulnerability detections align with Snyk’s latest advisories.

[coveralls]

Pull Request Test Coverage Report for Build 11653010628

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 82.581%

---

Totals
Change from base Build 11495456179:	0.0%
Covered Lines:	22387
Relevant Lines:	25677

---

💛 - Coveralls

[zanzoonh]

Looks great to me!

[AlAnoud2003]

Great integration of the tool!