[ryanduguid]

Summary

Adds a Snyk dependency test and its badge, next to CodeQL. Snyk tests Rust only through snyk sbom test, so each Cargo workspace is described as CycloneDX SBOMs (one per member) and each is tested; npm lockfiles are tested directly.

SNYK_TARGETS
cargo:.

It runs weekly, on manual dispatch and when a lockfile or the workflow changes. It fails when SNYK_TOKEN is missing, an SBOM cannot be generated or Snyk reports an issue.

Evidence

• actionlint: no findings.
• The workflow follows the Snyk workflows that ran in Ryan's other repositories, with the same action pins.

Merge danger

Door: two-way. Blast radius: CI

The Snyk job fails until the SNYK_TOKEN repository secret is set; then rerun it.

Unverified

• A Snyk scan has not run: the secret is not set yet.
• Snyk's free-plan test allowance for these tests was not checked.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

⚠️ Resolve issues before merging

The Snyk badge currently references a different repository, so it does not report this project's workflow status and should be corrected before merging.

The required workflow and badge behaviors have no automated validation coverage; in particular, failure paths and event triggers remain unverified.

Test suggestions

• Verify scheduled, manual, dependency-change, and workflow-change triggers
• Verify SBOM files are generated and each is scanned with Snyk
• Verify the job fails when SNYK_TOKEN is absent
• Verify the job fails when SBOM generation or Snyk scanning fails
• Verify the README Snyk badge links to this repository's workflow

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify scheduled, manual, dependency-change, and workflow-change triggers
2. Verify SBOM files are generated and each is scanned with Snyk
3. Verify the job fails when `SNYK_TOKEN` is absent
4. Verify the job fails when SBOM generation or Snyk scanning fails
5. Verify the README Snyk badge links to this repository's workflow

Low confidence findings

• Add automated validation for the workflow's triggers, SBOM/scanning failure paths, missing-secret behavior, and badge target.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Point both Snyk badge URLs at this repository's .github/workflows/snyk.yml so the badge reports this project's workflow status.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}