Snyk has no token

[wesley-dean-gsa]

Snyk depends on a secret named SNYK_TOKEN

https://github.com/GSA-TTS/tts.gsa.gov/blob/main/.github/workflows/snyk-security.yml#L52

[wesley-dean-gsa]

I put a few options in Slack:

So, we have a few options:

1. per the TTS Handbook, create a new "organization" for the project. This is a no-cost option and I recommend it.
2. try to get TTS to acquire (purchase) a TTS-wide Snyk license. This is likely even uglier than it sounds, so I strongly recommend against it at this time
3. disable Snyk scanning entirely. There are other tools we have in the toolchain (e.g., Dependabot) that will manage our dependencies or just notify us of issues (e.g., Grype, a part of MegaLinter), so the inclusion of Snyk can be seen as a redundancy. Personally, I don't mind having more rigorous scanning in this area, but Snyk is a widely-adopted tool with a good reputation. On the other hand, the site, when built, is static and immutable, so even if there is an undetected / unpatched dependency, the risk associated with an exploit is extremely low.

Right now, we're just waiting on advice about how to proceed.

[wesley-dean-gsa]

Chatted with @katelandisgsa and @JJediny and then sent an email along to LaKeisha Russel and @pauldoomgov soliciting their advice.

[wesley-dean-gsa]

@katelandisgsa wrote:

That being said, I'm comfortable with option 3 if you are.

I am, in fact, comfortable with option 3 (disable Snyk entirely), especially given #97.