Repository navigation
ci: apply .snyk ignores to the Snyk SBOM tests - #26
Conversation
snyk sbom test ignores .snyk, so an advisory ignored there would still fail the job. Each SBOM is now tested with --json; findings whose ID .snyk ignores for every path with an expiry still to come are dropped, every finding is printed as open or ignored, and any open one fails the job. A Snyk error (exit above 1), empty output or JSON without a vulnerabilities list still fails it. Without a .snyk nothing is ignored.
An empty JSON array or whitespace-only output produced no findings and passed. The filter now reads every JSON document and fails unless at least one result is present; an empty vulnerabilities list still passes.
|
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The workflow has a blocking ignore-parsing defect: wildcard ignore rules are treated as an array rather than iterated, so expiration dates are not read and applicable ignores will not be applied. The required behavior is also unverified because the new shell parsing and filtering paths lack automated tests.
Test suggestions
- An unexpired wildcard ignore suppresses a matching finding.
- Expired, path-specific, and open-ended ignores remain open and fail the job.
- Findings are printed with ignored/open status and open findings fail the job.
- Snyk exit codes above one, empty output, or malformed output fail the job.
- A missing .snyk file results in no ignored findings.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. An unexpired wildcard ignore suppresses a matching finding.
2. Expired, path-specific, and open-ended ignores remain open and fail the job.
3. Findings are printed with ignored/open status and open findings fail the job.
4. Snyk exit codes above one, empty output, or malformed output fail the job.
5. A missing .snyk file results in no ignored findings.
Low confidence findings
- Add automated coverage for the new shell parsing and filtering logic, and ensure the workflow explicitly provides or verifies the required yq executable rather than assuming it is present on the runner.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| with_entries(.value = ([.value[] | .["*"]? | .expires? // empty | ||
| | select((sub("\\.[0-9]+"; "") | fromdateiso8601) > now)] | max)) |
There was a problem hiding this comment.
🔴 HIGH RISK
Iterate over the wildcard path-rule array before reading expires, for example by changing .["*"]? | .expires? to .["*"][]? | .expires?.
TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.
* ci: apply .snyk ignores to the Snyk SBOM tests snyk sbom test ignores .snyk, so an advisory ignored there would still fail the job. Each SBOM is now tested with --json; findings whose ID .snyk ignores for every path with an expiry still to come are dropped, every finding is printed as open or ignored, and any open one fails the job. A Snyk error (exit above 1), empty output or JSON without a vulnerabilities list still fails it. Without a .snyk nothing is ignored. * ci: fail the Snyk job when its output holds no result An empty JSON array or whitespace-only output produced no findings and passed. The filter now reads every JSON document and fails unless at least one result is present; an empty vulnerabilities list still passes. --------- Co-authored-by: Ryan Duguid <ryanduguid@users.noreply.github.com>
Summary
snyk sbom testdoes not read.snyk, so an advisory ignored there still fails the Snyk job. The job now tests each SBOM with--jsonand applies.snykitself:Every finding is printed as
openorignored. Path-scoped, expired or open-ended ignores stay open. With no.snyk, nothing is ignored, so this changes nothing until one is added.Evidence
'*'ignore is dropped; expired, path-only and no-expiry ignores stay open;[], whitespace-only output and{"error":"x"}exit 5;{"vulnerabilities":[]}passes with no lines.Merge danger
Door: two-way. Blast radius: CI
A mistake here could pass a scan that should fail; the cases above are the checks against that.
Unverified
yqis assumed preinstalled on GitHub's ubuntu runners, as it is on PlutarchPages' runs.