fix(code-analysis): disabled code analysis (#116)

disable code argument with off-only option
snyk_security, ci github action workflows

.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+# This is a basic workflow to help you get started with Actions
+
+name: ci
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the "main" branch
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  build_test:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.9'
+          cache: 'pip'
+      - run: |
+          pip install -r requirements.txt --user
+          pip install -r requirements-dev.txt --user
+      - name: Test
+        id: test
+        run: pytest
+      - name: Pylint
+        id: pylint
+        run: pylint app --ignore-patterns=test_

.github/workflows/snyk_security.yml

@@ -0,0 +1,68 @@
+# This is a basic workflow to help you get started with Actions
+
+name: snyk_security
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push at "main" branch for security scans using secret snyk token
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  snyk_test:
+    if: |
+      github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+    runs-on: ubuntu-latest
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v3
+      # setup python for downloading package dependencies
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.9'
+          cache: 'pip'
+      - run: |
+          pip install -r requirements.txt --user
+          pip install -r requirements-dev.txt --user
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/python@master
+        continue-on-error: true # To make sure that SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --all-projects --sarif-file-output=snyk.sarif
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: snyk.sarif
+  snyk_monitor:
+    if: |
+      github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+    needs: snyk_test
+    runs-on: ubuntu-latest
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v3
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/python@master
+        continue-on-error: true # To make sure that SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          command: monitor
+          args: --all-projects

README.md

@@ -45,7 +45,7 @@ optional arguments:
   --sca {on,off}        scan for SCA manifests (on by default)
   --container {on,off}  scan for container projects, e.g. Dockerfile (on by default)
   --iac {on,off}        scan for IAC manifests (experimental, off by default)
-  --code {on,off}       create code analysis if not present (experimental, off by default)
+  --code {off}          code analysis is deprecated with off only option
   --dry-run             Simulate processing of the script without making changes to Snyk
   --skip-scm-validation
                         Skip validation of the TLS certificate used by the SCM
@@ -63,9 +63,10 @@ optional arguments:
 #### Sync Container projects only
 `./snyk_scm_refresh.py --org-id=12345 --sca=off --container=on`
 
-#### Enable Snyk Code analysis for repos
-only: `./snyk_scm_refresh.py --org-id=12345 --sca=off --container=off --code=on` \
-defaults + snyk code enable: `./snyk_scm_refresh.py --org-id=12345 --code=on`
+### Deprecated
+#### Snyk Code analysis for repos (Deprecated)
+~~only: `./snyk_scm_refresh.py --org-id=12345 --sca=off --container=off --code=on`~~</br>
+~~defaults + snyk code enable: `./snyk_scm_refresh.py --org-id=12345 --code=on`~~
 
 
 ### Dependencies

common.py

@@ -108,12 +108,13 @@ def parse_command_line_args():
         default=False,
         choices=['on', 'off']
     )
+    # show disabled argument help message and prevent invalidation of any existent "--code=off" verbose argument mode
     parser.add_argument(
         "--code",
-        help="create code analysis if not present (experimental, off by default)",
+        help="code analysis is deprecated with off only option",
         required=False,
         default=False,
-        choices=['on', 'off']
+        choices=['off']
     )
     parser.add_argument(
         "--dry-run",
@@ -177,4 +178,5 @@ def toggle_to_bool(toggle_value) -> bool:
 PROJECT_TYPE_ENABLED_SCA = toggle_to_bool(ARGS.sca)
 PROJECT_TYPE_ENABLED_CONTAINER = toggle_to_bool(ARGS.container)
 PROJECT_TYPE_ENABLED_IAC = toggle_to_bool(ARGS.iac)
-PROJECT_TYPE_ENABLED_CODE = toggle_to_bool(ARGS.code)
+# disabled snyk code due to unsupported underlying api changes
+PROJECT_TYPE_ENABLED_CODE = False