CMS-Enterprise/sbom-harbor

Update Snyk Enrichment to filter out non-Snyk packages

DerekStrickland opened this issue · 1 comments

Description

  • When the Snyk Enrichment provider was originally written it was the only source of Package data.
  • Now that the GitHub Provider is running against multiple GitHub orgs, the Snyk provider is attempting to process Package entries that are not relevant to it.
  • These end up in the logs as errors which is not ideal from an observability and monitoring perspective.
  • The Snyk Enrichment Task process loop needs to detect that the Package doesn't have a Snyk Xref, log an info level message that the Package is being skipped for this reason, and then continue to the next package without ever calling the Snyk service.
  • We should NOT modify the Snyk service, since we want to maintain this error handling as a way to detect any future similar logic problems.
sbolel commented

⚠️ Repository Decommission Notice: This repository is scheduled to be archived as it has been decommissioned and will no longer be actively maintained. As part of the archival process, we are closing all open issues and pull requests.