netlify-plugin-snyk

    1.3.3 • Public • Published

    netlify-plugin-snyk

    A Netlify Build plugin to find security vulnerabilities

    npm version license downloads build codecov Known Vulnerabilities Responsible Disclosure Policy

    About

    A Snyk Netlify build plugin to add to your Netlify website's pipeline and guard you from deploying static websites with known JavaScript vulnerabilities.

    Usage

    How to add security controls to your website build pipeline in 3 easy steps?

    1. Add the plugin!

      If you're using Netlify's UI, browse the Plugins directory and add netlify-plugin-snyk to your website project.

      Otherwise, if you use Netlify's configuration then add the plugin to your project's dependencies:

      npm install netlify-plugin-snyk --save-dev
      

      and then declare the plugin via a netlify.toml configuration file as follows:

      # netlify.toml
      [[plugins]]
      package = "netlify-plugin-snyk"
      
    2. Configure the Snyk API token

      If you alreay have the Snyk CLI installed you can get the token via snyk config get api and add an entry in Netlify's Environment variable settings page with variable name SNYK_TOKEN.

      Note: For CI integrations and alike, we recommend creating a Service account (available on the pro plan) at an org-level to avoid coupling the Snyk token to a personal user account.

    To obtain a Snyk API token visit your Snyk account page.

    1. Deploy safely 🐶

    How it works?

    • The Snyk security test runs on the onPreBuild event which means it gets triggered first, before a build has even started so it can fail fast and quick if any issues are found and you can attend to fixin them first.
    • The security scan will automatically detect the package manager used in the project and will only scan production dependencies to reduce signal-to-noise ratio.

    Configuration

    Plugin inputs

    The plugin can be configured via a plugins.inputs section on the netlify.toml file. For example:

    [[plugins]]
      package = "netlify-plugin-snyk"
    
      [plugins.inputs]
        failOnPreviews = true
        yarnWorkspaces = false
    

    Available plugin configuration via inputs:

    name description default
    failOnPreviews Set this to false if you want to allow deploy previews to pass with a failed Snyk security scan. true and it means deploy previews will fail if Snyk detects security issues
    yarnWorkspaces If your repository uses Yarn Workspaces set this to true which adds the --yarn-workspaces flag false

    Future configuration options to be added:

    • Set the Snyk organization to associate with the scan
    • Set severity level thresholds on which to fail
    • Set the Snyk API token via an input configuration (but recommend against setting it in code)
    • Set the plugin to automatically monitor the project on the Snyk UI (configurable to 'never', 'all', 'deploys')

    Contributing

    Please consult CONTRIBUTING for guidelines on contributing to this project.

    Install

    npm i netlify-plugin-snyk

    DownloadsWeekly Downloads

    73

    Version

    1.3.3

    License

    Apache-2.0

    Unpacked Size

    25.7 kB

    Total Files

    6

    Last publish

    Collaborators

    • snyk-admin