Repository navigation
Run Snyk Open Source monitor even when Snyk Code test fails - #56
Merged
Merged
Conversation
Neither step had an if: condition, so a Code (SAST) finding failing its step silently skipped Open Source (SCA) dependency monitoring too — confirmed on https://github.com/AviBackToBlack/lidaldi/actions/runs/30214194004/job/89825422862, where `Snyk Open Source monitor` shows skipped. The two scans are independent concerns; one failing shouldn't blind the other. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Now that the Open Source monitor step actually runs (previous commit), it surfaced a second issue: `snyk monitor --all-projects` reported "Missing required packages" for requirements.txt and tests/requirements.txt — this workflow only ever set up Node, so the two pip-based projects had nothing installed to resolve against. Added actions/setup-python + pip install, mirroring what's already done for the frontend's npm dependencies. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Per Devin Review on this PR: always() also runs a step when the job is cancelled, and cancel-in-progress cancels superseded PR runs — so a cancelled run could still push a snyk monitor snapshot (a persistent record) or attempt a SARIF upload. success()||failure() runs regardless of the Code test's pass/fail outcome (the actual intent) while still skipping on cancellation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
`snyk code test --sarif > snyk-code.sarif` redirects ALL output into the SARIF file, so a failing run's log shows nothing but "Process completed with exit code 1" — no indication it's real findings vs. a broken pipeline. --sarif-file-output writes the SARIF to disk while still printing the normal human-readable findings list (file, line, rule, severity) to the console. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Diagnostic only — will be reverted once the failing call is identified. Not for merge as-is. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Traced the trailing "403 Forbidden (SNYK-CLI-0000)" via -d debug
output: it's a single failed GET /rest/orgs/{id} call, where the CLI
tries to resolve the org ID into a display slug. The actual scan (POST
.../tests, result polling, findings retrieval) all succeed regardless
— this is a PAT-scope gap on a non-essential lookup, not a workflow
bug. Documented inline instead of leaving debug logging on permanently.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The CLI's only failing call was resolving SNYK_CFG_ORG's UUID into a
display slug via GET /rest/orgs/{id}, which 403s for this PAT's scopes.
Passing the slug (avibacktoblack, taken from the snyk monitor snapshot
URLs) directly should make that lookup unnecessary. Verifying with this
push before finalizing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Tested passing the org slug instead of the UUID to see if it'd skip
the GET /rest/orgs/{id} resolution call that 403s — it doesn't; the
CLI hits that endpoint regardless of which identifier format it's
given. So this is confirmed to be a PAT scope gap, not an identifier
format issue. Reverting to the UUID (more stable than a slug, which
can be renamed) and documenting the actual fix path inline.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Snyk Code testandSnyk Open Source monitorare independent scans, but neither step had anif:condition, so a Code finding failing its step (which is happening right now — 16 pre-existing findings) silently skips Open Source dependency monitoring too. Confirmed on the merge-to-main run for #47/#48/etc: https://github.com/AviBackToBlack/lidaldi/actions/runs/30214194004/job/89825422862 —Snyk Open Source monitorshowsskipped.Added
if: always()to the monitor step so it always runs and reports to Snyk regardless of the Code scan's outcome. Doesn't change the "Code findings fail the job" policy — just stops it from also blinding the separate SCA scan.Test plan
Snyk Open Source monitorshows as run (not skipped) on this PR, even withsnykstill failing overall🤖 Generated with Claude Code