Add Snyk CI security scanning for #4998#4999
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a token-gated GitHub Actions workflow that runs Snyk Code (SAST) and Snyk Open Source (SCA) on PRs and pushes to main, uploads SARIF results conditionally, updates ChangesSnyk CI Security Scanning
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error, 1 inconclusive)
✅ Passed checks (16 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security-snyk.yml:
- Around line 31-33: The workflow Checkout step currently invokes
actions/checkout without disabling credential persistence; update the Checkout
step (the step named "Checkout" that calls
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to add the input
persist-credentials: false so the default GITHUB_TOKEN is not written to the
repo git config for subsequent steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 715cc07f-d473-45d9-a494-442a4428f0bb
📒 Files selected for processing (3)
.github/workflows/security-snyk.yml.snykdocs/security.md
Greptile SummaryThis PR adds a rollout-safe Snyk CI security workflow triggered on PRs and pushes to
Confidence Score: 5/5CI/CD-only change with no application runtime modifications; safe to merge once the Snyk GitHub App and SNYK_TOKEN secret are in place. All three files are new additions to CI configuration and documentation. The workflow logic is sound: token-gated skipping works correctly for forks and pre-rollout, actions are SHA-pinned, both scan steps guard SARIF uploads with hashFiles checks, and the previously flagged bun.lock resolution gap has been addressed with --package-manager=npm and corresponding docs. No application code, auth logic, or data paths are touched. No files require special attention. Important Files Changed
Sequence DiagramsequenceDiagram
participant GHA as GitHub Actions
participant Snyk as Snyk CLI
participant GCS as GitHub Code Scanning
GHA->>GHA: Check SNYK_TOKEN present
alt Token absent
GHA->>GHA: Print skip message and exit clean
else Token present
GHA->>GHA: "checkout with persist-credentials=false"
GHA->>Snyk: snyk/actions/setup
GHA->>Snyk: "snyk code test . --severity-threshold=high --sarif-file-output=snyk-code.sarif"
Snyk-->>GHA: snyk-code.sarif or absent on error
alt SARIF present
GHA->>GCS: upload-sarif snyk-code.sarif category snyk-code-swift
else SARIF absent
GHA->>GHA: emit warning annotation
end
GHA->>GHA: Setup Bun and run bun install in web/
GHA->>Snyk: "snyk test --file=web/package.json --package-manager=npm --sarif-file-output=snyk-oss.sarif"
Snyk-->>GHA: snyk-oss.sarif or absent on error
alt SARIF present
GHA->>GCS: upload-sarif snyk-oss.sarif category snyk-open-source-web-npm
else SARIF absent
GHA->>GHA: emit warning annotation
end
end
Reviews (4): Last reviewed commit: "ci: decouple Snyk Code from web install" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/security-snyk.yml (1)
68-78:⚠️ Potential issue | 🟠 Major | ⚡ Quick winFix Snyk OSS scan for the Bun project (missing supported lockfile + swallowed failures).
web/contains onlybun.lockandpackage.json(noyarn.lock/pnpm-lock.yaml), but the workflow runssnyk test --file=web/package.jsonfor the “Snyk Open Source scan”, which can make the SCA dependency inventory incomplete versus using a Snyk-supported lockfile. Also,continue-on-error: trueon the scan step prevents failures from failing CI.Generate a Snyk-supported lockfile in
web/(e.g., createweb/yarn.lockviabun install --yarn—omit--frozen-lockfilefor first generation) and point Snyk at it (--file=web/yarn.lock), and remove/adjustcontinue-on-error: trueso Snyk errors actually break the pipeline.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/security-snyk.yml around lines 68 - 78, The "Snyk Open Source scan" step currently runs `snyk test --file=web/package.json` and uses `continue-on-error: true`, which causes incomplete inventory for Bun projects and hides failures; update the step to first generate a Snyk-supported lockfile in web/ (e.g., run `bun install --yarn` in that step to create web/yarn.lock without `--frozen-lockfile`) and change the snyk invocation to `snyk test --file=web/yarn.lock` (keeping existing flags like `--severity-threshold=high` and `--sarif-file-output=snyk-oss.sarif`), and remove or set `continue-on-error: false` so scan failures fail the job.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/security-snyk.yml:
- Around line 68-78: The "Snyk Open Source scan" step currently runs `snyk test
--file=web/package.json` and uses `continue-on-error: true`, which causes
incomplete inventory for Bun projects and hides failures; update the step to
first generate a Snyk-supported lockfile in web/ (e.g., run `bun install --yarn`
in that step to create web/yarn.lock without `--frozen-lockfile`) and change the
snyk invocation to `snyk test --file=web/yarn.lock` (keeping existing flags like
`--severity-threshold=high` and `--sarif-file-output=snyk-oss.sarif`), and
remove or set `continue-on-error: false` so scan failures fail the job.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 389bd438-6cf2-48cb-aa3d-8de56f058a72
📒 Files selected for processing (1)
.github/workflows/security-snyk.yml
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0599992. Configure here.
1 participant
manaflow-aiorg and grant access to the cmux repo.SNYK_TOKENrepo or org secret.Summary
main..snykpolicy anddocs/security.mdfor scanner scope, ignores, and fork behavior.Scope notes
highseverity and above.web/package.jsonin this v1. Swift Package Manager dependencies are resolved throughGhosttyTabs.xcodeproj/project.pbxproj/ Xcode project metadata rather than a top-levelPackage.swiftorPackage.resolved, so SPM SCA needs a follow-up design before enabling.SNYK_TOKENis unavailable, covering fork PRs, Dependabot PRs, and the pre-secret rollout window.Testing
Demo Video
N/A; CI/CD-only change.
Closes #4998
Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.Note
Low Risk
CI and documentation only; no application runtime, auth, or data-path changes. Operational risk is limited to secret setup and interpreting new code-scanning alerts.
Overview
Introduces Snyk security CI on pull requests and pushes to
main, gated so the job skips cleanly whenSNYK_TOKENis missing (forks, Dependabot, pre-rollout).When the token is present, the workflow runs Snyk Code (high+ SAST, SARIF category
snyk-code-swift) and Snyk Open Source againstweb/package.jsonafterbun install --frozen-lockfile(npm SCA fromnode_modules, categorysnyk-open-source-web-npm). Scan steps usecontinue-on-errorand warn if SARIF is absent; results upload viaupload-sarif.Adds root
.snykwith broad Code excludes (v1 Swift-focused SAST) anddocs/security.mddescribing scope, SARIF surfacing, fork behavior, and ignore policy.Reviewed by Cursor Bugbot for commit 6c8acc1. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Adds rollout-safe Snyk CI scanning on PRs and
main, uploading Snyk Code and Open Source SARIF to GitHub code scanning in separate categories. Snyk Code now runs before the web install;npmSCA runs afterbun install --frozen-lockfileresolving fromweb/node_modules(notbun.lock), fulfilling #4998.New Features
main; safe-skip whenSNYK_TOKENis missing.snyk-code-swift.web/package.json(high+); uploads assnyk-open-source-web-npm..snykanddocs/security.md.Migration
manaflow-ai/cmux.SNYK_TOKENsecret, then merge tomainto verify code scanning.Written for commit 6c8acc1. Summary will update on new commits.
Summary by CodeRabbit
Chores
Documentation