feat(security): add snyk scan

Author: KatoakDR

.github/workflows/build.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v3
 
-      - name: Setup node
+      - name: Setup Node
         uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc

.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup node
+      - name: Setup Node
         uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc

.github/workflows/snyk.yml

@@ -0,0 +1,66 @@
+# Use Snyk to find and fix vulnerabilities in your GitHub repository.
+# https://github.com/snyk/actions/
+
+name: Snyk Security
+
+on:
+  # Scan every Sunday at 1am
+  schedule:
+    - cron: '0 1 * * SUN'
+  # Scan every push to main branch
+  push:
+    branches:
+      - main
+  # Scan every pull request to main branch
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  snyk:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v3
+
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+
+      - name: Install dependencies
+        run: yarn install
+
+      - name: Setup Snyk
+        uses: snyk/actions/setup@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+      - name: Snyk Code Scan
+        run: snyk code test --sarif > snyk-code.sarif
+        continue-on-error: true # so that the SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+      - name: Snyk Open Source Monitor
+        run: snyk monitor --all-projects
+        continue-on-error: true # so that the SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+      - name: Upload results to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: snyk-code.sarif
+          category: Snyk

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v3
 
-      - name: Setup node
+      - name: Setup Node
         uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc