Snyk Python-3.6 Action
This image has been removed on 12 Aug 2024. It is highly recommended that users consider migrating to a newer action to ensure continued support and up-to-date functionality. If you are currently using this image, plan an upgrade as soon as possible to avoid any disruptions in your workflow post this date.
This page provides examples of using the Snyk GitHub Action for Python (3.6). For instructions on using the action and further information see GitHub Actions integration.
Using the Snyk Python (3.6) Action to check for vulnerabilities
The examples that follow show how you can use a Snyk Python GitHub Action.
Snyk requires that Python download the dependencies before running or triggering the Snyk checks.
The Python image checks and installs dependencies only if the manifest files are present in the current path, that is, the path from where the action is being triggered.
If pip is present on the current path , and Snyk finds a
requirements.txt
file, then Snyk runspip install -r requirements.txt
.If pipenv is present on the current path, and Snyk finds a
Pipfile
without aPipfile.lock
, then Snyk runspipenv update
.If
pyproject.toml
is present in the current path and Snyk does not findpoetry.lock
then Snyk runspip install poetry
.
If manifest files are present under any location other root then they must be installed prior to running Snyk.
You can use the Snyk Python (3.6) Action to check for vulnerabilities as follows:
You can use the Snyk Python (3.6) Action to check for only high severity vulnerabilities as follows:
Using the Snyk Python (3.6) Action to run snyk monitor
For an example of running snyk monitor
, see Snyk monitor example on the GitHub Actions integration page.
Uploading Snyk scan results to GitHub Code Scanning using the Snyk Python (3.6) Action
Using --sarif-file-output
Snyk CLI option and the GitHub SARIF upload action, you can upload Snyk scan results to GitHub Code Scanning as shown in the example that follows.
The Snyk Action fails when vulnerabilities are found. This would prevent the SARIF upload action from running. Thus you must use a continue-on-error option as shown in this example:
To use the upload-sarif option for private repos you must have GitHub Advanced Security.
If you see the error Advanced Security must be enabled for this repository to use code scanning
, check that GitHub Advanced Security is enabled. For more information, see "Managing security and analysis settings for your repository."
Last updated