/snyk-watcher

Primary LanguagePythonMIT LicenseMIT

How does it work?

Snyk-Watcher listens for webhooks to trigger events. It watches the main branch for the following events from Github:

  • Repository - Created, Deleted, Renamed
  • Pull Request - All

For the pull request webhooks, Snyk-Watcher will only try to import a project if it has been merged to main.

Installation

Snyk-Watcher runs completely standalone in a Docker container. We've included a docker-compose file to make it easy to build.

  1. Clone this repository.

  2. Build the container:

    docker-compose build

  3. Start Snyk-Watcher:

    docker-compose up

    You can verify that Snyk-Watcher is running by navigating to:

    localhost:8000/healthcheck

  4. In GitHub, go to the GitHub Apps developer setting and click New GitHub App.

  5. Enter the following values in the Register new GitHub App form:

    • GitHub App name: Snyk-Watcher
    • Webhook URL: {server}/github/webhook
    • Secret: {a highly random string}

  6. Give Snyk-Watcher access to the following Repository permissions:

    • Repository Administration (Read-only)
    • Metadata (Read-only)
    • Pull requests (Read-only)

  7. Subscribe to the following events:

    • Pull request
    • Repository

  8. Provide the Snyk-Watcher container your GitHub and Snyk tokens in these two environment variables:

    • SECRET_GITHUB_SECRET
    • SECRET_SNYK_API_TOKEN

  9. Test Snyk-Watcher by adding a new repository, then looking in the app’s advanced settings to see if the request was successful.

Limitations

  • At this time, Snyk-Watcher has been tested only with GitHub and GitHub Enterprise.
  • Snyk-Watcher does not have access to your code and does not make any changes to your GitHub organization or repositories.