# Snyk Software Composition Analysis Scan workflow (cypress-io/cypress)

> The Snyk Software Composition Analysis Scan workflow from cypress-io/cypress, explained and optimized by Latchkey.

Source: https://latchkey.dev/workflows/cypress-io-cypress-snyk-sca-scan  
Upstream: [cypress-io/cypress](https://github.com/cypress-io/cypress/blob/develop/.github/workflows/snyk_sca_scan.yaml) (.github/workflows/snyk_sca_scan.yaml), licence MIT

## What it does

This is the Snyk Software Composition Analysis Scan workflow from the cypress-io/cypress repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

## The workflow

```yaml
name: Snyk Software Composition Analysis Scan
# This git workflow leverages Snyk actions to perform a Software Composition
# Analysis scan on our Opensource libraries upon Pull Requests to the
# "develop" branch. We use this as a control to prevent vulnerable packages
# from being introduced into the codebase.
# Enhancements were made to this action to build the yarn packages to reduce
# Snyk scan errors that were complaining about the yarn.locks etc.  Also
# implemented PAT token for actions to resolve an issue with the action not
# running and reporting back to the PR status checks
on:
  pull_request:
    branches:
      - develop
      - release/*
  pull_request_target:
    branches:
      - develop
      - release/*
permissions:
  contents: read
jobs:
  Snyk_SCA_Scan:
    runs-on: ubuntu-latest
    # Route each PR to exactly one event: internal -> pull_request, fork -> pull_request_target.
    if: |
      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
    environment: ${{ github.event_name == 'pull_request_target' && 'fork-pr-review' || '' }}
    strategy:
      matrix:
        node-version: [22.x]
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: false
      - name: Set up Node.js
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: 22
          # Cache only on pull_request (internal PRs) - pull_request_target writes scope to the base branch and could be poisoned by an approved fork PR.
          cache: ${{ github.event_name == 'pull_request' && 'yarn' || '' }}
      - name: Run yarn
        run: yarn
      - name: Run build
        run: yarn build
      - name: Installing snyk-delta and dependencies
        run: npm i -g snyk-delta
      - uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1
      - name: Perform SCA Scan
        continue-on-error: false
        run: |
          snyk test --all-projects --strict-out-of-sync=false --detection-depth=6 --exclude=.nx,system-tests,tooling,docker,Dockerfile --severity-threshold=critical --org=cypress-opensource
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
          SNYK_API: https://api.snyk.io
```

## FAQ

### What does the Snyk Software Composition Analysis Scan workflow (cypress-io/cypress) workflow do?

This is the Snyk Software Composition Analysis Scan workflow from the cypress-io/cypress repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

### What CI health grade does this workflow get?

This Node.js workflow grades C. Paste your own workflow into the Latchkey grader to see its grade and the exact fixes.

### How can I improve this Node.js workflow?

Add run de-duplication and job timeouts. Latchkey applies these automatically on managed runners when you point runs-on at Latchkey.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt