workflows: upload snyk report to GitHub

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
2021-09-13 19:18:15 +02:00
parent 16b010ff4a
commit 0671a8b71c
1 changed files with 18 additions and 0 deletions
@@ -31,3 +31,21 @@ jobs:
            --remote-repo-url=https://github.com/backstage/backstage
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+      # Above we run the `monitor` command, this runs the `test` command which is
+      # the one that generates the SARIF report that we can upload to GitHub.
+      - name: Create Snyk report
+        uses: snyk/actions/node@master
+        continue-on-error: true # To make sure that SARIF upload gets called
+        with:
+          args: >
+            --yarn-workspaces
+            --org=backstage-dgh
+            --strict-out-of-sync=false
+            --sarif-file-output=snyk.sarif
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      - name: Upload Snyk report
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: snyk.sarif