integrate with snyk

.github/workflows/pr-merge-main.yml

@@ -56,4 +56,31 @@ jobs:
       - name: Update version
         uses: gradle/gradle-build-action@749f47bda3e44aa060e82d7b3ef7e40d953bd629
         with:
-          arguments: release -Prelease.useAutomaticVersion=true
+          arguments: release -Prelease.useAutomaticVersion=true
+
+  vulnerability-report:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      SNYK_ORG: legal-aid-agency
+      SNYK_TEST_EXCLUDE: build,generated
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Generate Snyk report and upload to LAA Dashboard
+        uses: snyk/actions/[email protected]
+        continue-on-error: true
+        with:
+          command: monitor
+          args: --org=${SNYK_ORG} --all-projects --exclude=$SNYK_TEST_EXCLUDE
+      - name: Generate sarif Snyk report
+        uses: snyk/actions/[email protected]
+        continue-on-error: true
+        with:
+          args: --org=${SNYK_ORG} --all-projects --exclude=$SNYK_TEST_EXCLUDE --sarif-file-output=snyk-report.sarif
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: snyk-report.sarif

.github/workflows/push-branch.yml

@@ -54,3 +54,35 @@ jobs:
           arguments: publish
         env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  vulnerability-scan:
+    runs-on: ubuntu-latest
+
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      SNYK_ORG: legal-aid-agency
+      SNYK_TEST_EXCLUDE: build,generated
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 21
+        uses: actions/setup-java@v3
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+      - uses: snyk/actions/[email protected]
+      - name: Install snyk-delta
+        run: |
+          npm config set prefix '~/.local/'
+          mkdir -p ~/.local/bin
+          export PATH="$HOME/.local/bin/:$PATH"
+          npm install -g snyk-delta
+      - name: Identify new vulnerabilities
+        run: ./snyk/snyk_delta_all_projects.sh --org=$SNYK_ORG --exclude=$SNYK_TEST_EXCLUDE
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run code test
+        uses: snyk/actions/[email protected]
+        with:
+          command: code test
+          args: --org=${SNYK_ORG}

.gitignore

@@ -93,3 +93,5 @@ test-results/
 
 .idea
 
+# Snyk
+.dccache

.snyk

@@ -0,0 +1,8 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.1
+ignore: {}
+patch: {}
+exclude:
+  global:
+    - assessment-service/src/test
+    - assessment-service/src/integrationTest

README.md

@@ -6,3 +6,46 @@ This API uses components from the [LAA CCMS Common Library](https://github.com/m
 
 - [laa-ccms-spring-boot-plugin](https://github.com/ministryofjustice/laa-ccms-spring-boot-common?tab=readme-ov-file#laa-ccms-spring-boot-gradle-plugin-for-java--spring-boot-projects)
 - [laa-ccms-spring-boot-starter-auth](https://github.com/ministryofjustice/laa-ccms-spring-boot-common/tree/main/laa-ccms-spring-boot-starters/laa-ccms-spring-boot-starter-auth)
+
+### Running Snyk locally
+To run Snyk locally, you will need to [install the Snyk CLI](https://docs.snyk.io/snyk-cli/install-or-update-the-snyk-cli).
+
+Once installed, you will be able to run the following commands:
+
+```shell
+snyk test
+```
+For open-source vulnerabilies and licence issues. See [`snyk test`](https://docs.snyk.io/snyk-cli/commands/test).
+
+```shell
+snyk code test
+```
+For Static Application Security Testing (SAST) - known security issues. See [`snyk code test`](https://docs.snyk.io/snyk-cli/commands/code-test).
+
+A [JetBrains Plugin](https://plugins.jetbrains.com/plugin/10972-snyk-security) is also available to integrate with your IDE. In addition to
+vulnerabilities, this plugin will also report code quality issues.
+
+### Configuration (`.snyk`)
+
+The [.snyk](.snyk) file is used to configure exclusions for scanning. If a vulnerability is not
+deemed to be a threat, or will be dealt with later, it can be added here to stop the pipeline
+failing. See [documentation](https://docs.snyk.io/manage-risk/policies/the-.snyk-file) for more details.
+
+### False Positives
+
+Snyk may report that new vulnerabilities have been introduced on a feature branch and fail the
+pipeline, even if this is not the case. As newly identified vulnerabilities are always being
+published, the report for the main branch may become outdated when a new vulnerability is published.
+
+If you think this may be the case, simply re-run the `monitor` command against the `main` branch
+to update the report on the Snyk server, then re-run your pipeline.
+
+Please ensure this matches the command used by the [pr-merge-main](.github/workflows/pr-merge-main.yml)
+workflow to maintain consistency.
+
+```shell
+snyk monitor --org=legal-aid-agency --all-projects --exclude=build,generated
+```
+
+You should then see the new vulnerability in the LAA Dashboard, otherwise it is a new
+vulnerability introduced on the feature branch that needs to be resolved.

snyk/snyk_delta_all_projects.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+
+
+#  Copyright 2018 Snyk Ltd.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+# Permalink: https://github.com/snyk-tech-services/snyk-delta/blob/1a45cc1ec6b390d8e1b266b157e00453a4d12eb5/snyk_delta_all_projects.sh
+
+# Call this script as you would call snyk test | snyk-delta, minus the --all-projects and --json flags
+# This is an interim fix until snyk-delta supports all projects itself (or snyk supports a --new flag)
+# example: /bin/bash snyk_delta_all_projects.sh --severity=high --exclude=tests,resources -- -s config.yaml
+# runs snyk test --all-projects --json $*
+# requires jq to be installed
+
+set -euo pipefail
+
+exit_code=0
+snyk_test_json=''
+formatted_json=''
+args=("$*")
+
+run_snyk_delta () {
+    # add in any other arguments you would like to use
+    snyk-delta
+}
+
+run_snyk_test () {
+    echo "Running: snyk test --all-projects --json" $args
+    local snyk_exit_code=0
+    {
+
+        snyk_test_json=`snyk test --all-projects --json $args`
+
+        } || {
+        snyk_exit_code=$?
+        if [ $snyk_exit_code -eq 2 ]
+        then
+            echo 'snyk test command was not successful, retry with -d to see more information'
+            exit 2
+        fi
+    }
+
+
+}
+
+format_snyk_test_output() {
+    echo "Processing snyk test --json output"
+    {
+        formatted_json=`echo $snyk_test_json | jq -r 'if type=="array" then .[] else . end | @base64'`
+        } || {
+        echo 'failed to process snyk-test result'
+        exit 2
+    }
+}
+
+
+#######
+# 1. run snyk test
+run_snyk_test
+
+# 2. format results to support single & multiple results returned
+format_snyk_test_output
+
+# 3. call snyk-delta for each result
+for test in `echo $formatted_json`; do
+    single_result="$(echo ${test} | base64 -d)" # use "base64 -d -i" on Windows, which will ignore any "gardage" characters echoing may add
+    project_name="$(echo ${single_result} | jq -r '.displayTargetFile')"
+    echo 'Processing: '  ${project_name}
+    if echo ${single_result} | run_snyk_delta
+    then
+        project_exit_code=$?
+        echo 'Finished processing'
+    else
+        project_exit_code=$?
+        if [ $project_exit_code -gt 1 ]
+        then
+            echo 'snyk-delta encountered an error, retrying.'
+            echo ${single_result} | run_snyk_delta
+        fi
+        echo 'Finished processing'
+    fi
+
+    if [ $project_exit_code -gt $exit_code ]
+    then
+        exit_code=$project_exit_code
+    fi
+    echo "Project: ${project_name} | Exit code: ${project_exit_code}"
+done
+
+echo "Overall exit code for snyk-delta-all-projects.sh: ${exit_code}"
+exit $exit_code