Skip to content

Commit 8ed0945

Browse files
jperezdealgabajperezdealgaba
committed
sast-snyk-check: added feature to ignore directories and files
Resolves: https://issues.redhat.com/browse/OSH-795 The parameter IGNORE has been added where users can input a list of files and directories (comma-separated) and they will be ignored using the snyk ignore functionality
1 parent a07704d commit 8ed0945

File tree

9 files changed

+46
-8
lines changed

9 files changed

+46
-8
lines changed

‎pipelines/docker-build-multi-platform-oci-ta/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
219219
|---|---|---|---|
220220
|ARGS| Append arguments.| | |
221221
|CACHI2_ARTIFACT| The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.| | '$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)'|
222+
|IGNORE_FILE_PATHS| Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.| | |
222223
|IMP_FINDINGS_ONLY| Report only important findings. Default is true. To report all findings, specify "false"| true| |
223224
|KFP_GIT_URL| URL from repository to download known false positives files| | |
224225
|PROJECT_NAME| Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.| | |

‎pipelines/docker-build-oci-ta/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
216216
|---|---|---|---|
217217
|ARGS| Append arguments.| | |
218218
|CACHI2_ARTIFACT| The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.| | '$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)'|
219+
|IGNORE_FILE_PATHS| Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.| | |
219220
|IMP_FINDINGS_ONLY| Report only important findings. Default is true. To report all findings, specify "false"| true| |
220221
|KFP_GIT_URL| URL from repository to download known false positives files| | |
221222
|PROJECT_NAME| Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.| | |

‎pipelines/docker-build/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
191191
|name|description|default value|already set by|
192192
|---|---|---|---|
193193
|ARGS| Append arguments.| | |
194+
|IGNORE_FILE_PATHS| Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.| | |
194195
|IMP_FINDINGS_ONLY| Report only important findings. Default is true. To report all findings, specify "false"| true| |
195196
|KFP_GIT_URL| URL from repository to download known false positives files| | |
196197
|PROJECT_NAME| Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.| | |

‎pipelines/maven-zip-build-oci-ta/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
121121
|---|---|---|---|
122122
|ARGS| Append arguments.| | |
123123
|CACHI2_ARTIFACT| The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.| | '$(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)'|
124+
|IGNORE_FILE_PATHS| Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.| | |
124125
|IMP_FINDINGS_ONLY| Report only important findings. Default is true. To report all findings, specify "false"| true| |
125126
|KFP_GIT_URL| URL from repository to download known false positives files| | |
126127
|PROJECT_NAME| Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.| | |

‎pipelines/maven-zip-build/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
9898
|name|description|default value|already set by|
9999
|---|---|---|---|
100100
|ARGS| Append arguments.| | |
101+
|IGNORE_FILE_PATHS| Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.| | |
101102
|IMP_FINDINGS_ONLY| Report only important findings. Default is true. To report all findings, specify "false"| true| |
102103
|KFP_GIT_URL| URL from repository to download known false positives files| | |
103104
|PROJECT_NAME| Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.| | |

‎task/sast-snyk-check-oci-ta/0.3/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ See https://snyk.io/product/snyk-code/ and https://snyk.io/ for more information
1313
|---|---|---|---|
1414
|ARGS|Append arguments.|""|false|
1515
|CACHI2_ARTIFACT|The Trusted Artifact URI pointing to the artifact with the prefetched dependencies.|""|false|
16+
|IGNORE_FILE_PATHS|Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.|""|false|
1617
|IMP_FINDINGS_ONLY|Report only important findings. Default is true. To report all findings, specify "false"|true|false|
1718
|KFP_GIT_URL|URL from repository to download known false positives files|""|false|
1819
|PROJECT_NAME|Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used.|""|false|

‎task/sast-snyk-check-oci-ta/0.3/sast-snyk-check-oci-ta.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ spec:
2727
the prefetched dependencies.
2828
type: string
2929
default: ""
30+
- name: IGNORE_FILE_PATHS
31+
description: Directories or files to be excluded from Snyk scan (Comma-separated).
32+
Useful to split the directories of a git repo across multiple components.
33+
type: string
34+
default: ""
3035
- name: IMP_FINDINGS_ONLY
3136
description: Report only important findings. Default is true. To report
3237
all findings, specify "false"
@@ -109,6 +114,8 @@ spec:
109114
value: $(params.SNYK_SECRET)
110115
- name: ARGS
111116
value: $(params.ARGS)
117+
- name: IGNORE_FILE_PATHS
118+
value: $(params.IGNORE_FILE_PATHS)
112119
- name: IMP_FINDINGS_ONLY
113120
value: $(params.IMP_FINDINGS_ONLY)
114121
- name: KFP_GIT_URL
@@ -164,6 +171,15 @@ spec:
164171
if [ "${IMP_FINDINGS_ONLY}" == "false" ]; then
165172
SEVERITY_THRESHOLD="low"
166173
fi
174+
175+
# We ignore files using snyk ignore if the user set up the IGNORE variable
176+
if [[ -n "${IGNORE_FILE_PATHS}" ]]; then
177+
paths="(${IGNORE_FILE_PATHS//,/ })" # Split by comma into an array
178+
for path in "${paths[@]}"; do
179+
(cd "${SOURCE_CODE_DIR}" && snyk ignore --file-path=source/"$path")
180+
done
181+
fi
182+
167183
set +e
168184
# We do want to expand ARGS (it can be multiple CLI flags, not just one)
169185
# shellcheck disable=SC2086

‎task/sast-snyk-check/0.3/README.md‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,15 @@ Snyk's SAST tool uses a combination of static analysis and machine learning tech
1010
1111
## Params:
1212

13-
| name | description | default value | required |
14-
|-----------------------|--------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------|----------|
15-
| SNYK_SECRET | Name of secret which contains Snyk token. | snyk-secret | true |
16-
| ARGS | Append arguments. | "" | false |
17-
| IMP_FINDINGS_ONLY | Report only important findings. To report all findings, specify "false" | true | true |
18-
| KFP_GIT_URL | Link to the known-false-positives repository. If left blank, results won't be filtered | "" | false |
19-
| PROJECT_NAME | Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used. | ${metadata.labels['appstudio.openshift.io/component']} | false |
20-
| RECORD_EXCLUDED | Write excluded records in file. Useful for auditing. | false | false |
13+
| name | description | default value | required |
14+
|--------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|---------------|----------|
15+
| SNYK_SECRET | Name of secret which contains Snyk token. | snyk-secret | true |
16+
| ARGS | Append arguments. | "" | false |
17+
| IGNORE_FILE_PATHS | Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components. | "" | false |
18+
| IMP_FINDINGS_ONLY | Report only important findings. To report all findings, specify "false" | true | true |
19+
| KFP_GIT_URL | Link to the known-false-positives repository. If left blank, results won't be filtered | "" | false |
20+
| PROJECT_NAME | Name of the scanned project, used to find path exclusions. By default, the Konflux component name will be used. | "" | false |
21+
| RECORD_EXCLUDED | Write excluded records in file. Useful for auditing. | false | false |
2122

2223
## How to obtain a snyk-token and enable snyk task on the pipeline:
2324

‎task/sast-snyk-check/0.3/sast-snyk-check.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,10 @@ spec:
5757
type: string
5858
description: Write excluded records in file. Useful for auditing (defaults to false).
5959
default: "false"
60+
- name: IGNORE_FILE_PATHS
61+
type: string
62+
description: Directories or files to be excluded from Snyk scan (Comma-separated). Useful to split the directories of a git repo across multiple components.
63+
default: ""
6064
volumes:
6165
- name: snyk-secret
6266
secret:
@@ -87,6 +91,8 @@ spec:
8791
value: $(params.SNYK_SECRET)
8892
- name: ARGS
8993
value: $(params.ARGS)
94+
- name: IGNORE_FILE_PATHS
95+
value: $(params.IGNORE_FILE_PATHS)
9096
- name: IMP_FINDINGS_ONLY
9197
value: $(params.IMP_FINDINGS_ONLY)
9298
- name: KFP_GIT_URL
@@ -142,6 +148,15 @@ spec:
142148
if [ "${IMP_FINDINGS_ONLY}" == "false" ]; then
143149
SEVERITY_THRESHOLD="low"
144150
fi
151+
152+
# We ignore files using snyk ignore if the user set up the IGNORE variable
153+
if [[ -n "${IGNORE_FILE_PATHS}" ]]; then
154+
paths="(${IGNORE_FILE_PATHS//,/ })" # Split by comma into an array
155+
for path in "${paths[@]}"; do
156+
(cd "${SOURCE_CODE_DIR}" && snyk ignore --file-path=source/"$path")
157+
done
158+
fi
159+
145160
set +e
146161
# We do want to expand ARGS (it can be multiple CLI flags, not just one)
147162
# shellcheck disable=SC2086

0 commit comments

Comments
 (0)