About

A Snyk Netlify build plugin to add to your Netlify website's pipeline and guard you from deploying static websites with known JavaScript vulnerabilities.

Usage

How to add security controls to your website build pipeline in 3 easy steps?

1. Add the plugin!

   If you're using Netlify's UI, browse the Plugins directory and add netlify-plugin-snyk to your website project.

   Otherwise, if you use Netlify's configuration then add the plugin to your project's dependencies:

   npm install netlify-plugin-snyk --save-dev

   and then declare the plugin via a netlify.toml configuration file as follows:

   # netlify.toml
   [[plugins]]
   package = "netlify-plugin-snyk"

2. Configure the Snyk API token

   If you alreay have the Snyk CLI installed you can get the token via snyk config get api and add an entry in Netlify's Environment variable settings page with variable name SNYK_TOKEN.

   Note: For CI integrations and alike, we recommend creating a Service account (available on the pro plan) at an org-level to avoid coupling the Snyk token to a personal user account.

To obtain a Snyk API token visit your Snyk account page.

3. Deploy safely 🐶

How it works?

• The Snyk security test runs on the onPreBuild event which means it gets triggered first, before a build has even started so it can fail fast and quick if any issues are found and you can attend to fixin them first.
• The security scan will automatically detect the package manager used in the project and will only scan production dependencies to reduce signal-to-noise ratio.

Configuration

Plugin inputs

The plugin can be configured via a plugins.inputs section on the netlify.toml file. For example:

[[plugins]]
  package = "netlify-plugin-snyk"

  [plugins.inputs]
    failOnPreviews = true
    yarnWorkspaces = false

Available plugin configuration via inputs:

| name | description | default | | ---------------- | -------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | failOnPreviews | Set this to false if you want to allow deploy previews to pass with a failed Snyk security scan. | true and it means deploy previews will fail if Snyk detects security issues | | yarnWorkspaces | If your repository uses Yarn Workspaces set this to true which adds the --yarn-workspaces flag | false |

Future configuration options to be added:

• Set the Snyk organization to associate with the scan
• Set severity level thresholds on which to fail
• Set the Snyk API token via an input configuration (but recommend against setting it in code)
• Set the plugin to automatically monitor the project on the Snyk UI (configurable to 'never', 'all', 'deploys')

Contributing

Please consult CONTRIBUTING for guidelines on contributing to this project.