-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into update_readme
- Loading branch information
Showing
4 changed files
with
68 additions
and
96 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
docs/architecture/decisions |
37 changes: 37 additions & 0 deletions
37
docs/architecture/decisions/0006-remove-snyk-in-favor-of-dependabot.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,37 @@ | ||
# 6. Remove Snyk in favor of Dependabot | ||
|
||
Date: 2024-07-17 | ||
|
||
## Status | ||
|
||
Accepted | ||
|
||
## Context | ||
|
||
Snyk, a security scanning tool, is being used to monitor for | ||
exploitable dependencies and notify us when they're found in | ||
our repository. | ||
|
||
Grype is another, similar tool that runs in a CI/CD also | ||
scans for dependency issues. Unlike Snyk, Grype is an | ||
OSS tool (even though we were using a free tier of Snyk's | ||
otherwise paid service). | ||
|
||
Dependabot also scans for dependencies that need to be | ||
updated; however, it's configured to run on a periodic | ||
basis (e.g., weekly). Therefore, even if a Pull Request | ||
(PR) isn't being considered, Dependabot will still run to | ||
look for dependencies that need to be updated and create | ||
PRs to include those updates. | ||
|
||
## Decision | ||
|
||
Remove Snyk in favor of Dependabot and Grype. | ||
|
||
## Consequences | ||
|
||
We have the best both worlds in that Grype runs when commits | ||
are pushed to PRs and Dependabot runs regularly even when | ||
there are no new commits to scan. Vulnerability data | ||
aren't being sent to Snyk, nor are we dependent upon a | ||
commercial platform for dependency scanning. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters