68 lines
2.2 KiB
YAML
68 lines
2.2 KiB
YAML
name: "Snyk"
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 0 * * *"
|
|
|
|
env:
|
|
DEFAULT_JDK_VERSION: 11
|
|
MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
|
|
|
|
jobs:
|
|
quarkus:
|
|
name: Quarkus
|
|
runs-on: ubuntu-latest
|
|
if: ${{ github.repository == 'keycloak/keycloak' }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3
|
|
|
|
- uses: actions/setup-java@v3
|
|
with:
|
|
java-version: ${{ env.DEFAULT_JDK_VERSION }}
|
|
distribution: temurin
|
|
cache: maven
|
|
|
|
- name: Build Quarkus
|
|
run: mvn -Psnyk-quarkus -pl quarkus/dist -am -DskipTests clean install
|
|
|
|
- uses: snyk/actions/setup@master
|
|
- name: Check for vulnerabilities
|
|
run: snyk test --policy-path=${GITHUB_WORKSPACE}/.github/snyk/.snyk --all-projects --prune-repeated-subdependencies --exclude=tests --sarif-file-output=quarkus-report.sarif quarkus
|
|
continue-on-error: true
|
|
env:
|
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
|
|
- name: Upload scanner results to GitHub
|
|
uses: github/codeql-action/upload-sarif@v2.1.33
|
|
with:
|
|
sarif_file: quarkus-report.sarif
|
|
|
|
operator:
|
|
name: Operator
|
|
runs-on: ubuntu-latest
|
|
if: ${{ github.repository == 'keycloak/keycloak' }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3
|
|
|
|
- uses: actions/setup-java@v3
|
|
with:
|
|
java-version: ${{ env.DEFAULT_JDK_VERSION }}
|
|
distribution: temurin
|
|
cache: maven
|
|
|
|
- name: Build Keycloak
|
|
run: mvn -Poperator -pl operator -am -DskipTests clean install
|
|
|
|
- uses: snyk/actions/setup@master
|
|
- name: Check for vulnerabilities for the Operator
|
|
run: snyk test --policy-path=${GITHUB_WORKSPACE}/.github/snyk/.snyk --all-projects --prune-repeated-subdependencies --exclude=tests --sarif-file-output=operator-report.sarif operator
|
|
continue-on-error: true
|
|
env:
|
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
|
|
- name: Upload scanner results for the Operator to GitHub
|
|
uses: github/codeql-action/upload-sarif@v2.1.33
|
|
with:
|
|
sarif_file: operator-report.sarif
|