search

cypress-io / cypress-chrome-recorder

Export Cypress Tests from Google Chrome DevTools' Recorder
MIT License
226 stars 18 forks source link

SEC-229 | Initial Commit of Snyk Git Actions #38

Closed cypresschris closed 7 months ago

cypresschris commented 1 year ago

This PR adds security controls in support of vulnerability scanning for third party packages as well as first party code.

Snyk is already implemented, but these actions bring the Cypress Tools into alignment with our vulnerability management strategy. The actions that this pull request introduces send the scan results back to the Snyk dashboard. The Snyk dashboard is then coupled with branch protection rules that dictate our levels of protection by blocking PRs where this git action fails as a check.

Once the solution is fully implemented, the failures you see on the PR related to this would prevent merges of the code to the 'develop' and 'master' branches. The exit status it failed with today indicates that there is a critical vulnerability in the code base. This PR aims to increase this type of visibility.

CLAassistant commented 1 year ago

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.