chore: add Snyk scans to docs (argoproj#9856)

* chore: generate Snyk reports Signed-off-by: Michael Crenshaw <[email protected]> sarif Signed-off-by: Michael Crenshaw <[email protected]> dashboard Signed-off-by: Michael Crenshaw <[email protected]> cron job Signed-off-by: Michael Crenshaw <[email protected]> more consistent formatting Signed-off-by: Michael Crenshaw <[email protected]> clarification Signed-off-by: Michael Crenshaw <[email protected]> sarif files Signed-off-by: Michael Crenshaw <[email protected]> fix naming, fix doc get text Signed-off-by: Michael Crenshaw <[email protected]> apply suggestions Signed-off-by: Michael Crenshaw <[email protected]> apply suggestions Signed-off-by: Michael Crenshaw <[email protected]> blarn Signed-off-by: CI <[email protected]> ignore errors due to vulns Signed-off-by: CI <[email protected]> specify target branch in script Signed-off-by: CI <[email protected]> don't checkout before running script Signed-off-by: CI <[email protected]> make sure dest dir exists Signed-off-by: CI <[email protected]> fix workflow Signed-off-by: CI <[email protected]> * update scans Signed-off-by: CI <[email protected]> * update reports Signed-off-by: CI <[email protected]> * use latest ignore rules Signed-off-by: CI <[email protected]> * update reports Signed-off-by: CI <[email protected]> * update reports Signed-off-by: CI <[email protected]> * update reports, add link to latest, push to master instead of stable Signed-off-by: CI <[email protected]> * fix for double-digit patch versions Signed-off-by: CI <[email protected]> * clean up testing changes Signed-off-by: CI <[email protected]>
alexef · Jul 27, 2022 · e3940cd · e3940cd
1 parent a329416
commit e3940cd
Show file tree

Hide file tree

Showing 37 changed files with 76,570 additions and 7 deletions.
diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml
@@ -58,10 +58,22 @@ jobs:
         run: |
           npm install -g snyk
 
-          # Run with high threshold to fail build.
-          snyk test --org=argoproj --all-projects --exclude=docs,site --severity-threshold=high --policy-path=.snyk
-          snyk iac test manifests/install.yaml --org=argoproj --severity-threshold=high --policy-path=.snyk
-
+          ./hack/snyk-non-container-tests.sh
+      - uses: github/codeql-action/upload-sarif@v1
+        if: github.event_name == 'push'
+        with:
+          category: Snyk code scan
+          sarif_file: /tmp/argocd-test.sarif
+      - uses: github/codeql-action/upload-sarif@v1
+        if: github.event_name == 'push'
+        with:
+          category: Snyk IaC scan for cluster install manifests
+          sarif_file: /tmp/argocd-iac-test-install.sarif
+      - uses: github/codeql-action/upload-sarif@v1
+        if: github.event_name == 'push'
+        with:
+          category: Snyk IaC scan for namespace install manifests
+          sarif_file: /tmp/argocd-iac-test-namespace-install.sarif
       - run: |
           IMAGE_PLATFORMS=linux/amd64
           if [[ "${{ github.event_name }}" == "push" || "${{ contains(github.event.pull_request.labels.*.name, 'test-arm-image') }}" == "true" ]]
@@ -74,13 +86,18 @@ jobs:
             -t quay.io/argoproj/argocd:latest .
         working-directory: ./src/github.com/argoproj/argo-cd
 
-      - name: Run container Snyk scan
+      - name: Run container Snyk scans
         if: github.event_name == 'push'
         working-directory: ./src/github.com/argoproj/argo-cd
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         run: |
-          snyk container test quay.io/argoproj/argocd:latest --org=argoproj --file=Dockerfile --severity-threshold=high
+          make snyk-container-tests
+      - uses: github/codeql-action/upload-sarif@v1
+        if: github.event_name == 'push'
+        with:
+          category: Snyk scan for Argo CD image
+          sarif_file: /tmp/argocd-image.sarif
 
       # deploy
       - run: git clone "https://[email protected]/argoproj/argoproj-deployments"

diff --git a/.github/workflows/update-snyk.yaml b/.github/workflows/update-snyk.yaml
@@ -0,0 +1,24 @@
+name: Snyk report update
+on:
+  schedule:
+    - cron: '0 0 * * 0' # midnight every Sunday
+jobs:
+  snyk-report:
+    name: Update Snyk report in the docs directory
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build reports
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          make snyk-report
+          git config --global user.email '[email protected]'
+          git config --global user.name 'CI'
+          git add docs/snyk/index.md
+          git add docs/snyk/*/*.html
+          git commit -m "[Bot] Update Snyk reports"
+          git push
diff --git a/Makefile b/Makefile
@@ -571,3 +571,15 @@ applicationset-controller:
 .PHONY: checksums
 checksums:
 	for f in ./dist/$(BIN_NAME)-*; do openssl dgst -sha256 "$$f" | awk ' { print $$2 }' > "$$f".sha256 ; done
+
+.PHONY: snyk-container-tests
+snyk-container-tests:
+	./hack/snyk-container-tests.sh
+
+.PHONY: snyk-non-container-tests
+snyk-non-container-tests:
+	./hack/snyk-non-container-tests.sh
+
+.PHONY: snyk-report
+snyk-report:
+	./hack/snyk-report.sh $(target_branch)
diff --git a/docs/snyk/index.md b/docs/snyk/index.md
@@ -0,0 +1,51 @@
+# Snyk Scans
+
+Every Sunday, Snyk scans are generated for Argo CD's `master` branch and the most recent patches of the three most
+recent minor releases.
+
+!!! note
+    For the most recent scans, view the [`latest` version of the docs](https://argo-cd.readthedocs.io/en/latest/snyk/).
+    You can return to your preferred version of the docs site using the dropdown selector at the top of the page.
+
+## Scans
+
+### master
+
+* [dependencies (golang and JavaScript)](master/argocd-test.html) — go.mod: 0 critical, 1 high, 2 medium, 0 low; ui/yarn.lock: 0 critical, 1 high, 1 medium, 0 low
+* [(image) ghcr.io/dexidp/dex:v2.32.0](master/ghcr.io_dexidp_dex:v2.32.0.html) — 0 critical, 2 high, 0 medium, 0 low
+* [(image) haproxy:2.0.29-alpine](master/haproxy:2.0.29-alpine.html) — 0 critical, 0 high, 0 medium, 0 low
+* [(image) quay.io/argoproj/argocd:latest](master/quay.io_argoproj_argocd:latest.html) — 0 critical, 0 high, 3 medium, 17 low
+* [(image) redis:7.0.4-alpine](master/redis:7.0.4-alpine.html) — 0 critical, 0 high, 0 medium, 0 low
+* [(IaC) manifests/install.yaml](master/argocd-iac-install.html)
+* [(IaC) manifests/namespace-install.yaml](master/argocd-iac-namespace-install.html)
+
+### v2.4.7
+
+* [dependencies (golang and JavaScript)](v2.4.7/argocd-test.html) — go.mod: 0 critical, 1 high, 3 medium, 0 low; ui/yarn.lock: 0 critical, 2 high, 1 medium, 0 low
+* [(image) ghcr.io/dexidp/dex:v2.30.2](v2.4.7/ghcr.io_dexidp_dex:v2.30.2.html) — 1 critical, 4 high, 0 medium, 1 low
+* [(image) haproxy:2.0.25-alpine](v2.4.7/haproxy:2.0.25-alpine.html) — 3 critical, 4 high, 0 medium, 1 low
+* [(image) quay.io/argoproj/argocd:v2.4.7](v2.4.7/quay.io_argoproj_argocd:v2.4.7.html) — 0 critical, 0 high, 3 medium, 17 low
+* [(image) redis:7.0.0-alpine](v2.4.7/redis:7.0.0-alpine.html) — 0 critical, 2 high, 0 medium, 0 low
+* [(IaC) manifests/install.yaml](v2.4.7/argocd-iac-install.html)
+* [(IaC) manifests/namespace-install.yaml](v2.4.7/argocd-iac-namespace-install.html)
+
+### v2.3.6
+
+* [dependencies (golang and JavaScript)](v2.3.6/argocd-test.html) — go.mod: 0 critical, 1 high, 3 medium, 0 low; ui/yarn.lock: 1 critical, 10 high, 24 medium, 2 low
+* [(image) ghcr.io/dexidp/dex:v2.30.2](v2.3.6/ghcr.io_dexidp_dex:v2.30.2.html) — 1 critical, 4 high, 0 medium, 1 low
+* [(image) haproxy:2.0.25-alpine](v2.3.6/haproxy:2.0.25-alpine.html) — 3 critical, 4 high, 0 medium, 1 low
+* [(image) quay.io/argoproj/argocd-applicationset:v0.4.1](v2.3.6/quay.io_argoproj_argocd-applicationset:v0.4.1.html) — 0 critical, 4 high, 38 medium, 29 low
+* [(image) quay.io/argoproj/argocd:v2.3.6](v2.3.6/quay.io_argoproj_argocd:v2.3.6.html) — 0 critical, 0 high, 4 medium, 17 low
+* [(image) redis:6.2.6-alpine](v2.3.6/redis:6.2.6-alpine.html) — 0 critical, 1 high, 0 medium, 0 low
+* [(IaC) manifests/install.yaml](v2.3.6/argocd-iac-install.html)
+* [(IaC) manifests/namespace-install.yaml](v2.3.6/argocd-iac-namespace-install.html)
+
+### v2.2.11
+
+* [dependencies (golang and JavaScript)](v2.2.11/argocd-test.html) — go.mod: 0 critical, 1 high, 3 medium, 0 low; ui/yarn.lock: 1 critical, 11 high, 32 medium, 2 low
+* [(image) ghcr.io/dexidp/dex:v2.30.2](v2.2.11/ghcr.io_dexidp_dex:v2.30.2.html) — 1 critical, 4 high, 0 medium, 1 low
+* [(image) haproxy:2.0.25-alpine](v2.2.11/haproxy:2.0.25-alpine.html) — 3 critical, 4 high, 0 medium, 1 low
+* [(image) quay.io/argoproj/argocd:v2.2.11](v2.2.11/quay.io_argoproj_argocd:v2.2.11.html) — 0 critical, 0 high, 4 medium, 25 low
+* [(image) redis:6.2.6-alpine](v2.2.11/redis:6.2.6-alpine.html) — 0 critical, 1 high, 0 medium, 0 low
+* [(IaC) manifests/install.yaml](v2.2.11/argocd-iac-install.html)
+* [(IaC) manifests/namespace-install.yaml](v2.2.11/argocd-iac-namespace-install.html)