Added trigger for Google Cloud Build #36
Conversation
There was a problem hiding this comment.
A few comments inline, but the major ones are:
- please install & use
snyk-to-htmlfor all supported products (we just added code) and get 4 separate artifacts, soresults-code.html,results-open-source.html,results-container.html,results-iac.html - please rename the file to
GoogleCloudBuild-docker-generic.yaml(the naming scheme will be detailed in a future README file, but the idea is roughly to explain within the filename where the file should go to, the type of installation for the snyk tool and the project type)
GoogleCloudBuild/config.yaml
Outdated
| args: | ||
| - '-c' | ||
| - |- | ||
| snyk config set api=${_SNYK_TOKEN} |
There was a problem hiding this comment.
does google cloud build support "before" directives, so that this command is only written once in this file?
There was a problem hiding this comment.
A YAML anchor would also help to make this DRYer: https://support.atlassian.com/bitbucket-cloud/docs/yaml-anchors/
| - '-c' | ||
| - |- | ||
| snyk config set api=${_SNYK_TOKEN} | ||
| snyk test --json-file-output=results-open-source.html || true |
There was a problem hiding this comment.
On the file output:
this line (and L16, L24, L32) do not produce the expected output.
--json-file-output will create a JSON file, not a HTML file as the name would suggest.
Please add a snyk-to-html step in between. You can refer to the example in
On the return code:
As shown in that file, we capture the return code and exit with it.
Unfortunately GCB does not support something like allow_failure, yet, so the exit line should be something like:
exit 0 # exit $RETURN_CODE
Which shows the developer our approach for exiting with 0 by default, but showing them how to enable the security gate again.
There was a problem hiding this comment.
I've checked in the wrong codes previously hence the confusion. Changes made.
| @@ -0,0 +1,42 @@ | |||
| # You can find the Snyk Official CLI container images here: https://github.com/snyk/cli#snyk-cli-in-a-docker-image | |||
There was a problem hiding this comment.
Please add a line or two of comments on the top of the file similar to other recently updated file to explain what is being shown in the file.
| entrypoint: bash | ||
| artifacts: | ||
| objects: | ||
| location: 'gs://<STORE_NAME>/scan_output' |
There was a problem hiding this comment.
I'm not familiar with GCB here, but is scan_output a local folder or is that a output folder?
There was a problem hiding this comment.
It's ok, I've removed this output folder on Google Cloud Storage. I will just store all in the root directory of the storage. All good.
| entrypoint: bash | ||
| artifacts: | ||
| objects: | ||
| location: 'gs://<STORE_NAME>/scan_output' |
There was a problem hiding this comment.
STORE_NAME seems to be a required variable. Please explain the requirement on the top of file as well.
| - '-c' | ||
| - |- | ||
| snyk config set api=${_SNYK_TOKEN} | ||
| snyk container test <CONTAINER_IMAGE> --json-file-output=results-container.html || true |
There was a problem hiding this comment.
please add the --file=Dockerfile parameter as well so it's easier to copy/paste
No description provided.