Keycloak

1
name: Snyk
2

3
on: 
4
  workflow_dispatch:
5

6
env:
7
  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
8

9
defaults:
10
  run:
11
    shell: bash
12

13
jobs:
14
  analysis:
15
    name: Analysis of Quarkus and Operator
16
    runs-on: ubuntu-latest
17
    if: github.repository == 'keycloak/keycloak'
18
    steps:
19
      - uses: actions/checkout@v4
20

21
      - name: Build Keycloak
22
        uses: ./.github/actions/build-keycloak
23

24
      - uses: snyk/actions/setup@master
25

26
      - name: Check for vulnerabilities in Quarkus
27
        run: snyk test --policy-path=${GITHUB_WORKSPACE}/.github/snyk/.snyk --all-projects --prune-repeated-subdependencies --exclude=tests --sarif-file-output=quarkus-report.sarif quarkus/deployment
28
        continue-on-error: true
29
        env:
30
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
31

32
      - name: Upload Quarkus scanner results to GitHub
33
        uses: github/codeql-action/upload-sarif@v3
34
        with:
35
          sarif_file: quarkus-report.sarif
36
          category: snyk-quarkus-report
37

38
      - name: Check for vulnerabilities in Operator
39
        run: |
40
          ./mvnw -Poperator -pl operator -am -DskipTests clean install
41
          snyk test --policy-path=${GITHUB_WORKSPACE}/.github/snyk/.snyk --all-projects --prune-repeated-subdependencies --exclude=tests --sarif-file-output=operator-report.sarif operator
42
        continue-on-error: true
43
        env:
44
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
45

46
      - name: Upload Operator scanner results to GitHub
47
        uses: github/codeql-action/upload-sarif@v3
48
        with:
49
          sarif_file: operator-report.sarif
50
          category: snyk-operator-report
51