CI/CD - Added Snyk C/C++ Scanning Job

[dealako]

• added example C/C++ Code scanner using the Snyk GitHub Action.
  The --unmanaged flag indicates this is for a C/C++ codebase. In this
  example, it currently scans on a new pull request to the 'main'
  branch. The repository administrator should set both the SNYK_ORG and
  SNYK_TOKEN environment variables before merging this PR. The
  environment variables can be obtained from the LFX Security team.

Signed-off-by: David Deal ddeal@linuxfoundation.org

---

• To see the specific tasks where the Asana app for GitHub is being used, see below:
  • https://app.asana.com/0/0/1206294838276359

[linux-foundation-easycla]

• ✅login: dealako / (c9dd7cd)

The committers listed above are authorized under a signed CLA.

[jmertic]

Hey all - for context we are working on how to enable LFX Security to scan for C/C++ dependencies. @dealako put this together which he tested locally; if we can get this working here then we can look to roll out to other ASWF projects that are primarily C/C++ based. Let me know if this all makes sense :-)

[lgritz]

Can you point us to an example of the kinds of problems this tries to identify in the code base?

And what does the "Monitor for NPM Vulnerabilities" step do, considering that this project doesn't use NPM in any way?

[JeanChristopheMorinPerso]

@lgritz The main thing this checks is vulnerabilities in dependencies and I think it might also check licenses used, see https://docs.snyk.io/scan-using-snyk/supported-languages-and-frameworks/c-c++.

[dealako]

And what does the "Monitor for NPM Vulnerabilities" step do, considering that this project doesn't use NPM in any way?

Sorry - this is not related to NPM (copy/paste error). I will fix it in the PR update.

Can you point us to an example of the kinds of problems this tries to identify in the code base?

More information here: https://docs.snyk.io/scan-using-snyk/supported-languages-and-frameworks/c-c++

[dealako]

I'm waiting for the CLA manager approvals 😩 (to resolve the EasyCLA check).

[dealako]

Expected usage and results:

❯ snyk test --unmanaged  --print-dep-paths --org=${SNYK_ORG}

Testing /Users/ddeal/projects/go/src/github.com/dealako/openexr...

Dependencies:

  https://github.com|academysoftwarefoundation/openexr@3.2.1-rc
  purl: pkg:generic/openexr@3.2.1-rc?download_url=https%3A%2F%2Fgithub.com%2FAcademySoftwareFoundation%2Fopenexr%2Farchive%2Fv3.2.1-rc.tar.gz
  confidence: 0.972
  matching files:
    - src/bin/exr2aces/main.cpp
    - src/bin/exrcheck/main.cpp
    - src/bin/exrenvmap/EnvmapImage.cpp
    ... and 411 more files

Tested 1 dependency for known issues, found 0 issues.

❯ snyk monitor --unmanaged --org=${SNYK_ORG}

Monitoring /Users/ddeal/projects/go/src/github.com/dealako/openexr (openexr)...

Explore this snapshot at https://app.snyk.io/org/openexr/project/82c0ea7b-6e7b-4cb3-b950-3137dc2dc158/history/0a62371c-1be6-4809-860a-bd3e84868b85

Notifications about newly disclosed issues related to these dependencies will be emailed to you.

[dealako]

@cary-ilm - any other changes or feedback?

[cary-ilm]

LGTM

[cary-ilm]

@dealako,I neglected to set up the SNYK_ORG and SNYK_TOKEN vars before merging. I've filed a ticket with LF IT support.

[jmertic]

Hey @cary-ilm - we did this at the org level - so nothing for you to worry about.

[cary-ilm]

Got it, thanks!

[cary-ilm]

Looks like the PR check (on #1604) is failing: https://github.com/AcademySoftwareFoundation/openexr/actions/runs/7490645510/job/20395759365?pr=1604

Snyk is missing auth token in order to run inside CI. You must include your API token as an environment value: `SNYK_TOKEN=12345678`

@jmertic, @dealako, are we still missing something?

[cary-ilm]

@dealako, @jmertic, the Snyk checks are still failing with this error:

Run snyk auth 
  snyk auth 
  shell: /usr/bin/bash -e {0}
Snyk is missing auth token in order to run inside CI. You must include your API token as an environment value: `SNYK_TOKEN=1[2](https://github.com/AcademySoftwareFoundation/openexr/actions/runs/7612900352/job/20739105771?pr=1616#step:5:2)[3](https://github.com/AcademySoftwareFoundation/openexr/actions/runs/7612900352/job/20739105771?pr=1616#step:5:3)[4](https://github.com/AcademySoftwareFoundation/openexr/actions/runs/7612900352/job/20739105771?pr=1616#step:5:5)[5](https://github.com/AcademySoftwareFoundation/openexr/actions/runs/7612900352/job/20739105771?pr=1616#step:5:6)678`
Error: Process completed with exit code 2.

You implied this has been configured at the org level, are we still missing something here?

[jmertic]

Hmm - this is added as an organization secret -> https://github.com/organizations/AcademySoftwareFoundation/settings/secrets/actions

@dealako Any suggestions? Maybe I put the wrong one in.

[jmertic]

Hi @cary-ilm - looks like the problem was that I can't spell 🤦 .

Can you try again and see if it works? Sorry about all that!

[cary-ilm]

What exactly did you change? I just re-ran one of the failed jobs and it failed again, but it's possible whatever you changed was not synced in?

[jmertic]

I had fixed the secret to have it re-spelled correctly. Can you point me to the job run?

[cary-ilm]

The latest Snyk action run: https://github.com/AcademySoftwareFoundation/openexr/actions/runs/7655813267

[jmertic]

I believe this issue is related to the fact that pull_reuqest triggers from branches not in the org don't have access to secrets for security reasons.

Using pull_request_target, I think, gets around that, but I also wonder if the better practice is to run the job on cron schedule vs on PRs. Not sure what you would think about that @dealako

[dealako]

@jmertic - ah yes. You are correct: GitHub article.

A cron schedule is a reasonable option (possibly complimentary) as rarely updated code repositories wouldn't benefit from frequent security updates and advisories. Having a periodic cron job would flag any new vulnerabilities even when the repository doesn't receive daily or weekly pull requests.

[dealako]

LMK if you'd like me to submit a PR to run the scan daily...or weekly.

[jmertic]

Please do for weekly - thanks!On Feb 5, 2024, at 3:31 PM, David Deal ***@***.***> wrote: LMK if you'd like me to submit a PR to run the scan daily...or weekly. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[cary-ilm]

+1 for a PR to run the scan weekly. Thanks!

[cary-ilm]

The PR scan is causing the CI check to fail on every PR now. I'm going to remove the workflow file snyk-scan-pr.yml altogether. @dealako, when you submit a PR for a weekly scan, presumably it will be a different workflow anyway.