Snyk 導入指引

# macOS / Linux
brew install snyk

# Windows
choco install snyk

# npm
npm install -g snyk

# 登入 Snyk（需免費帳號）
snyk auth

# 使用 API Token（CI 用）
export SNYK_TOKEN=your-api-token
snyk auth $SNYK_TOKEN

# 掃描專案
snyk test

# 自動修復
snyk wizard

# 只顯示高危漏洞
snyk test --severity-threshold=high

# 掃描 Docker Image
snyk container test my-app:latest

# 掃描 Dockerfile
snyk container test my-app:latest --file=Dockerfile

# 掃描 Terraform
snyk iac test terraform/

# 掃描 Kubernetes YAML
snyk iac test k8s/

# 掃描 CloudFormation
snyk iac test cloudformation/

# 掃描 git 歷史中的 Secret
snyk code test

# 掃描特定目錄
snyk code test src/

<plugin>
    <groupId>io.snyk</groupId>
    <artifactId>snyk-maven-plugin</artifactId>
    <version>2.4.0</version>
    <configuration>
        <failOnIssues>true</failOnIssues>
        <severityThreshold>high</severityThreshold>
    </configuration>
</plugin>

mvn snyk:test

- stage: SecurityScan
  jobs:
    - job: Snyk
      steps:
        - script: |
            npm install -g snyk
            snyk test --severity-threshold=high
          env:
            SNYK_TOKEN: $(SNYK_TOKEN)
          displayName: 'Snyk Dependency Test'
        - script: |
            snyk container test $(DockerImage) --severity-threshold=high
          env:
            SNYK_TOKEN: $(SNYK_TOKEN)
          displayName: 'Snyk Container Test'

- name: Snyk Security
  uses: snyk/actions@master
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  with:
    args: --severity-threshold=high