chore: add snyk integration

[gokaygurcan]

Hi,

I finished these two:

• Run a command in package.json for the snyk app to report the dependency vulnerabilities.
• snyk badge

But when I ran snyk test, it found 9 vulnerabilities and 46 vulnerable paths. I'm not sure if they are in the scope of this issue. Please let me know if you want me to update those packages.

Thanks,
G.

---

Closes #496

[kylemh]

Looks like Travis is unhappy with this integration. I don't see that you've made any mistakes, but I'll need reviews from our Infra and Backend team. They're a bit in flux atm, but we'll get your PR merged ASAP assuming we can do so with no further work on your end.

[mwagz]

Looks like it doesn't know what snyk is. I'm wondering if you have snyk installed globally, but the project isn't aware of it.

yarn test v0.24.4
$ snyk test && node scripts/test.js --env=jsdom 
sh: 1: snyk: not found
error Command failed with exit code 127.
make: *** [test] Error 1

We might just need to npm install snyk --save-dev here, but maybe the infrastructure team will have more insight.

[gokaygurcan]

Ah! You're right. Since I have it installed globally, I didn't have any problem with the command. Adding it as a dev dependency in a minute.

[kylemh]

Travis still is not pleased, and the log is not helpful at all hahaha

[gokaygurcan]

I checked the logs, it says snyk test requires an authenticated account. Please run "snyk auth" and try again. and I don't have that kind of access. It looks like, someone needs to follow these steps to setup Travis to work with Snyk: https://snyk.io/docs/ci

And a blog post about it: https://blog.travis-ci.com/2017-04-20-continuous-security-snyk-travis-ci/

Please let me know if there's more I can do. But at this point, I don't know how I can help more.

[kylemh]

We'll merge this as soon as we are able, @gokaygurcan

[sethbergman]

This just needs a snyk account created by an organization admin. That's all.

[kylemh]

@gokaygurcan believe it or not I'm still on this... Trying to get environment variables to work. Everything is up to date. Will merge soon.

[gokaygurcan]

Hi @kylemh,
Thanks for informing me, I'm also getting notifications and keep tracking the progress. I hope it'll land on master soon and you'll start using it.

Good luck! In case you need me, I'm just a mention away ;)

[sethbergman]

I unintentionally closed this by pushing to your master branch @gokaygurcan. All of your contributions will carry over into the upcoming PR. Since the earlier comments indicate closes #496, it automatically closed the issue and PR.

[gokaygurcan]

Hi,
no worries. Glad that it worked in the end ;)