Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Initial Snyk integraiton #24

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Initial Snyk integraiton #24

wants to merge 3 commits into from

Conversation

isavov
Copy link

@isavov isavov commented Mar 21, 2023

Description:
This PR modifies PR checks to add Snyk vulnerability scanning and fail the checks on vulnerabilities that are of High or Critical severity.
It also keeps the snapshot used for ongoing monitoring updated on the Snyk servers to the current develop branch.

  • Add PR check step
  • Add workflow for Snyk monitoring
  • Add gradle snyk plugin

Related issue(s):

Fixes #

Notes for reviewer:

Checklist

  • Documented (Code comments, README, etc.)
  • Tested (unit, integration, etc.)

@isavov isavov self-assigned this Mar 21, 2023
@isavov isavov added the New Feature A new feature, service, or documentation. Major changes that are not backwards compatible. label Mar 21, 2023
Copy link
Member

@nathanklick nathanklick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflows are broken due to a missing npm dependency.

@isavov isavov force-pushed the snyk branch 2 times, most recently from 6d58b9b to e1b4efc Compare April 20, 2023 16:03
@isavov
Copy link
Author

isavov commented Apr 20, 2023

The workflows are broken due to a missing npm dependency.

Fixed the issue and also disabled snyk checks for forks

isavov added 3 commits August 9, 2023 20:49
Signed-off-by: Iliya Savov <[email protected]>
Signed-off-by: Iliya Savov <[email protected]>
Signed-off-by: Iliya Savov <[email protected]>
}
abstract class SnykCodeTask : io.snyk.gradle.plugin.SnykTask() {
@TaskAction
fun doSnykTest() {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Codacy found a medium Error Prone issue: The function doSnykTest is missing documentation.

The issue highlighted by the linter detekt is that the doSnykTest function is missing documentation. In Kotlin, it's considered a good practice to document the public API of your code. This includes classes, interfaces, functions, and their non-private members. Documentation is typically added directly above the declaration using a documentation comment, which starts with /** and ends with */.

To fix this issue, you should add a documentation comment to the doSnykTest function that explains what the function does, its parameters (if any), and what it returns or any side effects it may have (such as throwing an exception). This will help other developers understand the purpose and usage of the function without having to read its implementation details.

Here's an example of how you can add documentation to the doSnykTest function:

Suggested change
fun doSnykTest() {
/**
* Executes the Snyk Code Test task.
* This function authenticates with Snyk, runs the Snyk command for code testing,
* and logs the output. If the command exits with a non-zero exit code,
* a GradleException is thrown indicating that the Snyk Code Test failed.
*
* @throws GradleException if the Snyk Code Test command fails.
*/
fun doSnykTest() {
// Function implementation remains the same
}

Adding documentation comments like the one above will resolve the issue reported by detekt and improve the maintainability of your code.


This comment was generated by an experimental AI tool.

plugins {
id("io.snyk.gradle.plugin.snykplugin")
}
abstract class SnykCodeTask : io.snyk.gradle.plugin.SnykTask() {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Codacy found a medium Error Prone issue: SnykCodeTask is missing required documentation.

The issue reported by the linter detekt is that the SnykCodeTask abstract class is missing required documentation. In Kotlin, as in many other programming languages, it is considered good practice to document classes, interfaces, functions, etc., especially when they are part of a public API or intended to be used by other developers. This documentation usually takes the form of a comment block above the class declaration that explains the purpose and usage of the class.

To fix this issue, you should add a KDoc comment block above the SnykCodeTask class declaration. KDoc is Kotlin's documentation system, which uses a syntax similar to Java's Javadoc. This comment should provide a clear description of what the class is for and any important information that a developer using this class should know.

Here is an example of how you might document the SnykCodeTask class:

Suggested change
abstract class SnykCodeTask : io.snyk.gradle.plugin.SnykTask() {
/**
* `SnykCodeTask` is an abstract Gradle task for running Snyk Code tests within the build process.
* It extends the `SnykTask` provided by the Snyk Gradle plugin and defines the `doSnykTest` method
* to execute the Snyk Code analysis and handle the results.
*
* The task will perform authentication and then run the Snyk Code test command. If the test
* results in an exit code greater than 0, indicating an issue was found, a `GradleException`
* will be thrown, causing the build to fail.
*/
abstract class SnykCodeTask : io.snyk.gradle.plugin.SnykTask() {
// Class implementation
}

By adding this documentation, you will resolve the linter issue, and other developers will have a better understanding of the purpose and functionality of the SnykCodeTask class.


This comment was generated by an experimental AI tool.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
New Feature A new feature, service, or documentation. Major changes that are not backwards compatible.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants