@ckeditor/ckeditor5-dev-ci 54.6.0 → 54.7.0

package/README.md

@@ -132,21 +132,25 @@ These commands accept a mix of environment variables and command line arguments.
 - ⚙️ **`ckeditor5-dev-ci-trigger-snyk-scan`**
 
   Publishes Snyk code and dependency snapshots for the current branch.
-  It configures the Snyk CLI to use the EU endpoint and the provided organization, then runs `snyk code test --report` and `snyk monitor --all-projects --detection-depth=2`.
+  It configures the Snyk CLI to use the EU endpoint and the provided organization, then runs `snyk code test` and `snyk monitor` commands.
 
   **Environment variables:**
   - `SNYK_TOKEN` — Snyk token used for authentication.
+  - `DEBUG` — *(Optional)* When set, appends `-d` to `snyk code test` and `snyk monitor` for verbose output, and removes `--silent` from the `pnpm` invocation.
 
   **CircleCI-provided variables:**
   - `CIRCLE_BRANCH` — Git branch used as Snyk's `target-reference`.
 
   **Parameters:**
+  - `--depth` — *(Optional)* Detection depth passed to `snyk monitor` as `--detection-depth`. Defaults to `2`.
+  - `--exclude` — *(Optional, repeatable)* Additional directory or file name to exclude from Snyk's dependency snapshot. Use multiple times, for example `--exclude=build --exclude=dist`. The provided values are **merged** with the built-in defaults (`external`, `tests`, `node_modules`, `release`, `scripts`).
   - `--organization` — Snyk organization ID or slug.
 
   **Behavior:**
-  - Limits dependency snapshot detection to the repository root and `packages/*`, so test fixtures and deeper nested manifests are ignored.
-  - Accepts exit code `1` from `snyk code test --report`, so code snapshots are still published when vulnerabilities are found.
-  - Requires exit code `0` from `snyk monitor --all-projects`, because any other code means the dependency snapshot was not created.
+  - Always excludes `external`, `tests`, `node_modules`, `release` and `scripts` from dependency snapshot detection. Any paths provided via `--exclude` are merged with these defaults (duplicates are ignored).
+  - Passes `--detection-depth` (default: `2`) to `snyk monitor` to limit how deep Snyk scans for manifest files, which avoids performance issues caused by deeply nested `node_modules` trees.
+  - Accepts exit code `1` from `snyk code test`, so code snapshots are still published when vulnerabilities are found.
+  - Requires exit code `0` from `snyk monitor`, because any other code means the dependency snapshot was not created.
 
 ## Changelog
 

package/bin/circle-workflow-notifier.js

@@ -112,8 +112,9 @@ async function waitForOtherJobsAndSendNotification() {
 		return waitForOtherJobsAndSendNotification();
 	}
 
-	// If any ignored job failed, all of its children will be marked as 'failed_parent', and thus will not trigger this check.
-	const anyJobsFailed = jobs.some( job => job.status === 'failed' );
+	// If any ignored job failed or was canceled, all of its children will be marked as
+	// 'failed_parent', and thus will not trigger this check.
+	const anyJobsFailed = jobs.some( job => job.status === 'failed' || job.status === 'canceled' );
 
 	if ( anyJobsFailed ) {
 		return execSync( task, { stdio: 'inherit' } );

package/bin/trigger-snyk-scan.js

@@ -9,12 +9,22 @@ import { parseArgs } from 'node:util';
 import runSnykCommand from '../lib/run-snyk-command.js';
 
 const SNYK_ENDPOINT = 'https://api.eu.snyk.io';
+const DEFAULT_EXCLUDE = [ 'node_modules', 'external', 'release', 'scripts', 'tests' ];
 
 try {
-	const { CIRCLE_BRANCH, SNYK_TOKEN } = process.env;
+	const { CIRCLE_BRANCH, SNYK_TOKEN, DEBUG } = process.env;
 
 	const { values } = parseArgs( {
 		options: {
+			depth: {
+				default: '2',
+				type: 'string'
+			},
+			exclude: {
+				default: [],
+				multiple: true,
+				type: 'string'
+			},
 			organization: {
 				type: 'string'
 			}
@@ -34,6 +44,8 @@ try {
 		throw new Error( 'Missing environment variable: CIRCLE_BRANCH' );
 	}
 
+	const exclude = [ ...new Set( [ ...DEFAULT_EXCLUDE, ...values.exclude ] ) ];
+
 	await runSnykCommand( [ 'config', 'set', `endpoint=${ SNYK_ENDPOINT }` ] );
 	await runSnykCommand( [ 'config', 'set', `org=${ values.organization }` ] );
 
@@ -43,7 +55,8 @@ try {
 			'test',
 			'--report',
 			'--project-name=Code analysis',
-			`--target-reference=${ CIRCLE_BRANCH }`
+			`--target-reference=${ CIRCLE_BRANCH }`,
+			...( DEBUG ? [ '-d' ] : [] )
 		],
 
 		/**
@@ -57,8 +70,10 @@ try {
 		[
 			'monitor',
 			'--all-projects',
-			'--detection-depth=2',
-			`--target-reference=${ CIRCLE_BRANCH }`
+			`--exclude=${ exclude.join( ',' ) }`,
+			`--detection-depth=${ values.depth }`,
+			`--target-reference=${ CIRCLE_BRANCH }`,
+			...( DEBUG ? [ '-d' ] : [] )
 		],
 
 		/**

package/lib/process-job-statuses.js

@@ -64,6 +64,11 @@ function isJobFailed( job ) {
 		return true;
 	}
 
+	// See: https://github.com/ckeditor/ckeditor5/issues/19978.
+	if ( job.status === 'canceled' ) {
+		return true;
+	}
+
 	if ( job.status === 'failed_parent' ) {
 		return true;
 	}
@@ -85,7 +90,7 @@ function clone( obj ) {
  *
  * @property {string} id
  *
- * @property {'blocked'|'running'|'failed'|'failed_parent'|'success'} status
+ * @property {'blocked'|'running'|'failed'|'canceled'|'failed_parent'|'success'|'skipped'} status
  *
  * @property {Array.<string>} dependencies
  */

package/lib/run-snyk-command.js

@@ -3,6 +3,7 @@
  * For licensing, see LICENSE.md.
  */
 
+import path from 'node:path';
 import { spawn } from 'node:child_process';
 
 /**
@@ -14,10 +15,14 @@ import { spawn } from 'node:child_process';
  * @returns {Promise<void>}
  */
 export default function runSnykCommand( snykArguments, allowedExitCodes = [ 0 ] ) {
+	const snykExecutablePath = path.resolve( import.meta.dirname, '..', 'node_modules', '.bin', 'snyk' );
+	const pnpmFlags = process.env.DEBUG ? [] : [ '--silent' ];
+
 	return new Promise( ( resolve, reject ) => {
-		const childProcess = spawn( 'pnpm', [ '--silent', 'exec', 'snyk', ...snykArguments ], {
+		const childProcess = spawn( 'pnpm', [ ...pnpmFlags, 'exec', snykExecutablePath, ...snykArguments ], {
 			cwd: process.cwd(),
-			stdio: 'inherit'
+			stdio: 'inherit',
+			shell: process.platform === 'win32'
 		} );
 
 		childProcess.on( 'error', reject );

package/lib/utils/is-workflow-finished.js

@@ -6,6 +6,8 @@
 const FINISHED_STATUSES = [
 	'success',
 	'failed',
+	// See: https://github.com/ckeditor/ckeditor5/issues/19978.
+	'canceled',
 	'failed_parent',
 	// See: https://github.com/ckeditor/ckeditor5/issues/18359.
 	'skipped'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-dev-ci",
-  "version": "54.6.0",
+  "version": "54.7.0",
   "description": "Utils used on various Continuous Integration services.",
   "keywords": [],
   "author": "CKSource (http://cksource.com/)",