chore: integrate snyk security scanning via GitHub Actions by Aaravanand00 · Pull Request #126 · hyperledger-identus/integration

Aaravanand00 · 2026-04-22T09:15:00Z

Added snyk.yml workflow for security scanning with restricted read-only permissions
Running in warn-only mode initially to prevent breaking CI; can be enforced in future
Configured to run on push to main and all pull requests
Note: Scan will fail if SNYK_TOKEN is missing in repository secrets

Copilot

Pull request overview

Integrates Snyk security scanning into CI via a new GitHub Actions workflow, and documents the requirement for a repository SNYK_TOKEN.

Changes:

Added .github/workflows/snyk.yml to run snyk test on PRs and pushes, and snyk monitor on pushes to main.
Documented Snyk CI scanning and required secret in the README.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
README.md	Adds documentation for Snyk scanning and the required `SNYK_TOKEN` secret.
.github/workflows/snyk.yml	New workflow that sets up Node, installs dependencies, and runs Snyk scan/monitor in CI.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-22T09:19:28Z

+      - name: Run Snyk test
+        # Run in warn-only mode initially to avoid breaking CI; can be enforced in future
+        run: snyk test --severity-threshold=high
+        continue-on-error: true
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+


SNYK_TOKEN is injected for all pull_request runs. For PRs originating from forks, repository secrets are unavailable so this step will consistently error (even if the job stays green due to continue-on-error), creating noisy logs and effectively skipping scanning. Gate Snyk steps on the presence of the secret (e.g., if: secrets.SNYK_TOKEN != '') and/or skip PR runs from forks so the workflow behaves predictably.

Copilot · 2026-04-22T09:19:28Z

+      - name: Snyk monitor
+        run: snyk monitor
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'


The PR description says the workflow runs in "warn-only mode" initially, but snyk monitor can still fail the job (e.g., due to missing token or transient Snyk API issues) on pushes to main. If the intent is truly warn-only for now, consider also making the monitor step non-blocking (continue-on-error) and/or explicitly skipping it when SNYK_TOKEN is not set.

Copilot · 2026-04-22T09:19:28Z

+- CI runs a Snyk scan on every push and pull request to help identify known vulnerabilities.
+- Requires a `SNYK_TOKEN` to be configured in the repository secrets for the scan to authenticate.


README notes that CI runs Snyk on every push/PR and that a SNYK_TOKEN is required, but on forked pull requests secrets are not provided by GitHub Actions. Consider clarifying that scans may be skipped/limited for fork PRs unless an alternative auth approach is used, so contributors understand why a scan might not run.

Suggested change

- CI runs a Snyk scan on every push and pull request to help identify known vulnerabilities.

- Requires a `SNYK_TOKEN` to be configured in the repository secrets for the scan to authenticate.

- CI runs a Snyk scan on pushes and pull requests to help identify known vulnerabilities.

- Authenticated Snyk scans require a `SNYK_TOKEN` to be configured in the repository secrets.

- On pull requests from forks, GitHub Actions does not provide repository secrets by default, so Snyk scans may be skipped or run in a limited way unless an alternative authentication approach is configured.

Copilot · 2026-04-22T09:19:29Z

+        run: npm ci
+
+      - name: Setup Snyk
+        uses: snyk/actions/setup@v3


This workflow uses snyk/actions/setup@v3 as a floating tag. Elsewhere in the repo, third-party actions are pinned to a commit SHA (e.g., ossf/scorecard-action@4eaacf… in .github/workflows/scorecard.yml:49). Please pin the Snyk action to a specific commit SHA as well to reduce supply-chain risk.

Suggested change

uses: snyk/actions/setup@v3

uses: snyk/actions/setup@<FULL_40_CHARACTER_COMMIT_SHA_FOR_V3> # v3

Copilot · 2026-04-22T09:19:29Z

+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        if: hashFiles('package.json') != ''
+        uses: actions/setup-node@v4


This repository pins GitHub Actions to full commit SHAs (e.g., actions/checkout@de0fac… in .github/workflows/ci.yml:27) for supply-chain security, but this workflow uses floating tags (actions/checkout@v4, actions/setup-node@v4). Please pin these to specific commit SHAs to match the established convention and reduce the risk of a compromised upstream tag.

Suggested change

- uses: actions/checkout@v4

- name: Setup Node.js

if: hashFiles('package.json') != ''

uses: actions/setup-node@v4

- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332

- name: Setup Node.js

if: hashFiles('package.json') != ''

uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8

Copilot · 2026-04-22T09:19:29Z

+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+


All other workflows add a "Harden the runner" step via step-security/harden-runner (e.g., .github/workflows/codeql.yml:42-46), but this workflow does not. Consider adding the same hardening step (and egress policy) here to keep runner security consistent across CI workflows.

Suggested change

- name: Harden the runner

uses: step-security/harden-runner@v2

with:

egress-policy: audit

Copilot · 2026-04-22T09:19:29Z

+permissions:
+  contents: read
+
+jobs:
+  snyk:
+    runs-on: ubuntu-latest


Workflow-level permissions are set explicitly here, but the repo convention is permissions: {} at the workflow level and then narrow permissions per-job (see .github/workflows/ci.yml:11-19). To keep permissions reviewable and consistent, set workflow permissions to {} and move contents: read under jobs.snyk.permissions.

Suggested change

permissions:

contents: read

jobs:

snyk:

runs-on: ubuntu-latest

permissions: {}

jobs:

snyk:

runs-on: ubuntu-latest

permissions:

contents: read

- Added snyk.yml workflow for security scanning with restricted read-only permissions - Running in warn-only mode initially to prevent breaking CI; can be enforced in future - Configured to run on push to main and all pull requests - Gated Snyk steps to skip on fork PRs where SNYK_TOKEN is unavailable - Pinned actions to full commit SHAs for enhanced security - Added runner hardening and narrowed job-level permissions Signed-off-by: Aaravanand00 <aaravanand5749@gmail.com>

sonarqubecloud · 2026-04-22T09:29:46Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot AI review requested due to automatic review settings April 22, 2026 09:15

Aaravanand00 requested a review from amagyar-iohk as a code owner April 22, 2026 09:15

Copilot started reviewing on behalf of Aaravanand00 April 22, 2026 09:15 View session

Aaravanand00 force-pushed the chore/integrate-snyk-security branch from 5440dfb to 9ea02e5 Compare April 22, 2026 09:16

Copilot AI reviewed Apr 22, 2026

View reviewed changes

Aaravanand00 force-pushed the chore/integrate-snyk-security branch from 9ea02e5 to aadd71b Compare April 22, 2026 09:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: integrate snyk security scanning via GitHub Actions#126

chore: integrate snyk security scanning via GitHub Actions#126
Aaravanand00 wants to merge 1 commit intohyperledger-identus:mainfrom
Aaravanand00:chore/integrate-snyk-security

Aaravanand00 commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

Copilot AI Apr 22, 2026

Uh oh!

sonarqubecloud Bot commented Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		- CI runs a Snyk scan on every push and pull request to help identify known vulnerabilities.
		- Requires a `SNYK_TOKEN` to be configured in the repository secrets for the scan to authenticate.

-- CI runs a Snyk scan on every push and pull request to help identify known vulnerabilities.
-- Requires a `SNYK_TOKEN` to be configured in the repository secrets for the scan to authenticate.
+- CI runs a Snyk scan on pushes and pull requests to help identify known vulnerabilities.
+- Authenticated Snyk scans require a `SNYK_TOKEN` to be configured in the repository secrets.
+- On pull requests from forks, GitHub Actions does not provide repository secrets by default, so Snyk scans may be skipped or run in a limited way unless an alternative authentication approach is configured.

	uses: snyk/actions/setup@v3
	uses: snyk/actions/setup@<FULL_40_CHARACTER_COMMIT_SHA_FOR_V3> # v3

+      - name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit

Conversation

Aaravanand00 commented Apr 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Apr 22, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants