Skip to end of metadata
Go to start of metadata
You are viewing an old version of this page. View the current version.
Compare with Current
View Page History
Version 1
Next »
Date
11 Dec 2020
Attendees
Discussion items
| Time | Item | Who | Notes |
|---|
| Review Security Issues | Team | Review Kanban board (no new issues that haven't been reviewed) |
| Snyk token | Julian Ladisch | Synk has two ways to analyze maven projects:
a) Run maven to create a dependency tree from all pom.xml files and use the result for Snyk analysis, or
b) Snyk directly fetches the pom.xml files but doesn't resolve the dependency before analyzing.
The reports from b) are unusable because it has many false positives and false negatives, see this screenshot. On the left a) with julianladisch/raml-module-builder where a GitHub action runs maven and then the snyk analysis and on the right b) with folio-org/raml-module-builder where Snyk directly fetches the pom.xml files. 
To run the GitHub actions for a) we need to put the SNYK_TOKEN into the GitHub secrets settings. Temporarily the ryandberger Snyk token is used in the julianladisch repository. Should we create a folio-org Snyk organisation and token to be used for https://github.com/folio-org/ that is free for open source, or should we use the ryandberger Snyk organisation and token? |
| Safe harbor, policies | | |