From 45913d893ee099e02101794017d21a1f5db6018d Mon Sep 17 00:00:00 2001 From: Bruno De Assis Marques Date: Fri, 30 Oct 2026 16:16:57 +1100 Subject: [PATCH] ci: remove Snyk scan and monitor Signed-off-by: Bruno De Assis Marques --- .github/workflows/flow-build-application.yaml | 7 -- .../workflows/flow-pull-request-checks.yaml | 14 ---- .github/workflows/zxc-code-analysis.yaml | 67 +-------------- .github/workflows/zxf-snyk-monitor.yaml | 82 ------------------- 4 files changed, 1 insertion(+), 169 deletions(-) delete mode 100644 .github/workflows/zxf-snyk-monitor.yaml diff --git a/.github/workflows/flow-build-application.yaml b/.github/workflows/flow-build-application.yaml index 8bc7895af..0409e2e01 100644 --- a/.github/workflows/flow-build-application.yaml +++ b/.github/workflows/flow-build-application.yaml @@ -33,11 +33,6 @@ on: type: boolean required: false default: false - enable-snyk-scan: - description: "Snyk Scan Enabled" - type: boolean - required: false - default: false java-version: description: "Java JDK Version:" type: string @@ -87,12 +82,10 @@ jobs: java-version: ${{ github.event.inputs.java-version || '21.0.1' }} java-distribution: ${{ github.event.inputs.java-distribution || 'temurin' }} gradle-version: ${{ github.event.inputs.gradle-version || 'wrapper' }} - enable-snyk-scan: ${{ github.event_name == 'push' || github.event.inputs.enable-snyk-scan == 'true' }} enable-sonar-analysis: ${{ github.event_name == 'push' || github.event.inputs.enable-sonar-analysis == 'true' }} enable-codecov-analysis: ${{ github.event_name == 'push' || github.event.inputs.enable-unit-tests == 'true' }} secrets: gradle-cache-username: ${{ secrets.GRADLE_CACHE_USERNAME }} gradle-cache-password: ${{ secrets.GRADLE_CACHE_PASSWORD }} sonar-token: ${{ secrets.SONAR_TOKEN }} - snyk-token: ${{ secrets.SNYK_TOKEN }} codecov-token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/flow-pull-request-checks.yaml b/.github/workflows/flow-pull-request-checks.yaml index 6b5d7d114..f75bc114c 100644 --- a/.github/workflows/flow-pull-request-checks.yaml +++ b/.github/workflows/flow-pull-request-checks.yaml @@ -86,17 +86,3 @@ jobs: gradle-cache-username: ${{ secrets.GRADLE_CACHE_USERNAME }} gradle-cache-password: ${{ secrets.GRADLE_CACHE_PASSWORD }} sonar-token: ${{ secrets.SONAR_TOKEN }} - - snyk: - name: Snyk Scan - uses: ./.github/workflows/zxc-code-analysis.yaml - needs: - - unit-tests - if: ${{ github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name && github.actor != 'dependabot[bot]' }} - with: - custom-job-label: Standard - enable-snyk-scan: true - secrets: - gradle-cache-username: ${{ secrets.GRADLE_CACHE_USERNAME }} - gradle-cache-password: ${{ secrets.GRADLE_CACHE_PASSWORD }} - snyk-token: ${{ secrets.SNYK_TOKEN }} diff --git a/.github/workflows/zxc-code-analysis.yaml b/.github/workflows/zxc-code-analysis.yaml index 401918c4a..988901caa 100644 --- a/.github/workflows/zxc-code-analysis.yaml +++ b/.github/workflows/zxc-code-analysis.yaml @@ -35,11 +35,6 @@ on: type: boolean required: false default: false - enable-snyk-scan: - description: "Snyk Scan Enabled" - type: boolean - required: false - default: false java-distribution: description: "Java JDK Distribution:" type: string @@ -75,9 +70,6 @@ on: sonar-token: description: "The SonarCloud access token used by the SonarQube agent to report an analysis." required: false - snyk-token: - description: "The Snyk access token is used by Snyk to analyze the code for vulnerabilities " - required: false codecov-token: description: "The CodeCov access token is used by CodeCov.io to analyze the code coverage " required: false @@ -124,7 +116,7 @@ jobs: with: gradle-version: ${{ inputs.gradle-version }} - # Node.JS 16.x is required for the Snyk CLI, Sonar Scan, and CodeCov steps below. + # Node.JS 16.x is required for the Sonar Scan and CodeCov steps below. - name: Setup Node uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: @@ -171,60 +163,3 @@ jobs: with: gradle-version: ${{ inputs.gradle-version }} arguments: sonar --info --scan ${{ steps.sonar-cloud.outputs.options }} - - - name: Setup Snyk - env: - SNYK_TOKEN: ${{ secrets.snyk-token }} - if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }} - run: npm install -g snyk snyk-to-html @wcj/html-to-markdown-cli - - - name: Snyk Scan - id: snyk - env: - SNYK_TOKEN: ${{ secrets.snyk-token }} - if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }} - run: snyk test --all-projects --severity-threshold=high --json-file-output=snyk-test.json - - - name: Snyk Code - id: snyk-code - env: - SNYK_TOKEN: ${{ secrets.snyk-token }} - if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }} - run: snyk code test --severity-threshold=high --json-file-output=snyk-code.json - - - name: Publish Snyk Results - if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }} - run: | - if [[ -f "snyk-test.json" && -n "$(cat snyk-test.json | tr -d '[:space:]')" ]]; then - snyk-to-html -i snyk-test.json -o snyk-test.html --summary - html-to-markdown snyk-test.html -o snyk - cat snyk/snyk-test.html.md >> $GITHUB_STEP_SUMMARY - fi - - if [[ -f "snyk-code.json" && -n "$(cat snyk-code.json | tr -d '[:space:]')" ]]; then - snyk-to-html -i snyk-code.json -o snyk-code.html --summary - html-to-markdown snyk-code.html -o snyk - cat snyk/snyk-code.html.md >> $GITHUB_STEP_SUMMARY - fi - - - name: Check Snyk Files - if: ${{ always() }} - run: | - echo "::group::Snyk File List" - ls -lah snyk* || true - echo "::endgroup::" - echo "::group::Snyk Test Contents" - cat snyk-test.json || true - echo "::endgroup::" - echo "::group::Snyk Code Contents" - cat snyk-code.json || true - echo "::endgroup::" - - - name: Publish Snyk Reports - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - if: ${{ inputs.enable-snyk-scan && !cancelled() && !failure() }} - with: - name: Snyk Reports - path: | - snyk-*.html - snyk-*.json diff --git a/.github/workflows/zxf-snyk-monitor.yaml b/.github/workflows/zxf-snyk-monitor.yaml deleted file mode 100644 index 421a792aa..000000000 --- a/.github/workflows/zxf-snyk-monitor.yaml +++ /dev/null @@ -1,82 +0,0 @@ -## -# Copyright (C) 2023-2026 Hedera Hashgraph, LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -## - -name: "ZXF: Snyk Monitor" -# The purpose of this job is to run on each commit to the main branch and daily at midnight UTC on the most recent commit. -# This job is not intended to be run manually, but rather to be run when triggered by either a commit or the schedule. - -on: - push: - branches: - - main - schedule: - - cron: "0 0 * * 0" - -permissions: - contents: read - -env: - GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }} - GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }} - -jobs: - snyk: - name: Snyk Monitor - runs-on: solo-linux-medium - steps: - - name: Harden Runner - uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1 - with: - egress-policy: audit - - - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - - name: Setup Java - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1 - with: - distribution: temurin - java-version: 21.0.1 - - - name: Setup Gradle - uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0 - with: - gradle-version: wrapper - - # Node.JS 16.x is required for the Snyk CLI. - - name: Setup NodeJS - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 - with: - node-version: 16 - - # This step may be optional since Snyk analysis does not require the binary artifacts to be built first. However, - # Snyk will fail if the code does not compile and the error messages are less than helpful. Therefore, we will - # compile the code first and then run Snyk so that we can get diagnostic information if the code does not compile. - - name: Compile - uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0 - with: - gradle-version: wrapper - arguments: assemble --scan - - - name: Setup Snyk - run: npm install -g snyk - - # This step is what actually uploads the Snyk analysis to the Snyk Cloud. The Snyk token is stored as a secret - # in the Github repository and is passed to the Snyk CLI via the environment variable SNYK_TOKEN. - - name: Run Snyk Monitor - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - run: snyk monitor --all-projects