[DO-1619] Snyk integration in Github workflows

.github/workflows/cd.yml

@@ -70,3 +70,19 @@ jobs:
           bundle exec fastlane ios deploy --env ios.$FLAVOUR
         env:
           GIT_TOKEN: ${{ secrets.RADIX_BOT_PAT }}
+
+  snyk_online_monitor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+      - uses: actions/setup-node@v2
+        with:
+          node-version: '14'
+      - name: Install snyk
+        run: |
+          npm install snyk -g
+          snyk -v
+          snyk auth ${{ secrets.SNYK_TOKEN }}
+      - name: Enable Snyk online monitoring to check for vulnerabilities
+        run: |
+          snyk monitor --all-projects --org=${{ secrets.SNYK_ORG_ID }}

.github/workflows/ci.yml

@@ -12,6 +12,25 @@ concurrency:
 
 jobs:
 
+  snyk_scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+      - uses: actions/setup-node@v2
+        with:
+          node-version: '14'
+      - name: Install snyk
+        run: |
+          npm install snyk -g
+          snyk -v
+          snyk auth ${{ secrets.SNYK_TOKEN }}
+      - name: Snyk deps and licences scan
+        run: |
+          snyk test --all-projects --org=${{ secrets.SNYK_ORG_ID }} --severity-threshold=high
+      - name: Snyk code scan
+        run: |
+          snyk code test --all-projects --org=${{ secrets.SNYK_ORG_ID }} --severity-threshold=high
+
   linting:
     name: "Linting"
     runs-on: macos-13

.github/workflows/release.yml

@@ -0,0 +1,31 @@
+name: Release
+
+on:
+  release:
+    types:
+      - "published"
+
+jobs:
+
+  publish_sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
+      - uses: actions/setup-node@v2
+        with:
+          node-version: '14'
+      - name: Install snyk
+        run: |
+          npm install snyk -g
+          snyk -v
+          snyk auth ${{ secrets.SNYK_TOKEN }}
+      - name: Generate SBOM
+        run: |
+          snyk sbom --all-projects --org=${{ secrets.SNYK_ORG_ID }} --format=cyclonedx1.4+json --json-file-output sbom.json
+      - name: Upload SBOM
+        uses: svenstaro/upload-release-action@2b9d2847a97b04d02ad5c3df2d3a27baa97ce689 # v2.6.1
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: sbom.json
+          tag: ${{ github.ref }}
+          overwrite: true