@ckeditor/ckeditor5-dev-ci 54.6.1 → 54.7.0

package/README.md

@@ -132,22 +132,25 @@ These commands accept a mix of environment variables and command line arguments.
 - ⚙️ **`ckeditor5-dev-ci-trigger-snyk-scan`**
 
   Publishes Snyk code and dependency snapshots for the current branch.
-  It configures the Snyk CLI to use the EU endpoint and the provided organization, then runs `snyk code test --report` and `snyk monitor --all-projects --exclude=external,tests`.
+  It configures the Snyk CLI to use the EU endpoint and the provided organization, then runs `snyk code test` and `snyk monitor` commands.
 
   **Environment variables:**
   - `SNYK_TOKEN` — Snyk token used for authentication.
+  - `DEBUG` — *(Optional)* When set, appends `-d` to `snyk code test` and `snyk monitor` for verbose output, and removes `--silent` from the `pnpm` invocation.
 
   **CircleCI-provided variables:**
   - `CIRCLE_BRANCH` — Git branch used as Snyk's `target-reference`.
 
   **Parameters:**
-  - `--exclude` — *(Optional, repeatable)* Directory or file name passed to Snyk's `--exclude`. Use multiple times, for example `--exclude=external --exclude=tests`. Defaults to `external` and `tests`.
+  - `--depth` — *(Optional)* Detection depth passed to `snyk monitor` as `--detection-depth`. Defaults to `2`.
+  - `--exclude` — *(Optional, repeatable)* Additional directory or file name to exclude from Snyk's dependency snapshot. Use multiple times, for example `--exclude=build --exclude=dist`. The provided values are **merged** with the built-in defaults (`external`, `tests`, `node_modules`, `release`, `scripts`).
   - `--organization` — Snyk organization ID or slug.
 
   **Behavior:**
-  - Excludes directories and files named `external` and `tests` from dependency snapshot detection by default, and allows overriding that list with repeated `--exclude` flags.
-  - Accepts exit code `1` from `snyk code test --report`, so code snapshots are still published when vulnerabilities are found.
-  - Requires exit code `0` from `snyk monitor --all-projects`, because any other code means the dependency snapshot was not created.
+  - Always excludes `external`, `tests`, `node_modules`, `release` and `scripts` from dependency snapshot detection. Any paths provided via `--exclude` are merged with these defaults (duplicates are ignored).
+  - Passes `--detection-depth` (default: `2`) to `snyk monitor` to limit how deep Snyk scans for manifest files, which avoids performance issues caused by deeply nested `node_modules` trees.
+  - Accepts exit code `1` from `snyk code test`, so code snapshots are still published when vulnerabilities are found.
+  - Requires exit code `0` from `snyk monitor`, because any other code means the dependency snapshot was not created.
 
 ## Changelog
 

package/bin/trigger-snyk-scan.js

@@ -9,14 +9,19 @@ import { parseArgs } from 'node:util';
 import runSnykCommand from '../lib/run-snyk-command.js';
 
 const SNYK_ENDPOINT = 'https://api.eu.snyk.io';
+const DEFAULT_EXCLUDE = [ 'node_modules', 'external', 'release', 'scripts', 'tests' ];
 
 try {
-	const { CIRCLE_BRANCH, SNYK_TOKEN } = process.env;
+	const { CIRCLE_BRANCH, SNYK_TOKEN, DEBUG } = process.env;
 
 	const { values } = parseArgs( {
 		options: {
+			depth: {
+				default: '2',
+				type: 'string'
+			},
 			exclude: {
-				default: [ 'external', 'tests' ],
+				default: [],
 				multiple: true,
 				type: 'string'
 			},
@@ -39,6 +44,8 @@ try {
 		throw new Error( 'Missing environment variable: CIRCLE_BRANCH' );
 	}
 
+	const exclude = [ ...new Set( [ ...DEFAULT_EXCLUDE, ...values.exclude ] ) ];
+
 	await runSnykCommand( [ 'config', 'set', `endpoint=${ SNYK_ENDPOINT }` ] );
 	await runSnykCommand( [ 'config', 'set', `org=${ values.organization }` ] );
 
@@ -48,7 +55,8 @@ try {
 			'test',
 			'--report',
 			'--project-name=Code analysis',
-			`--target-reference=${ CIRCLE_BRANCH }`
+			`--target-reference=${ CIRCLE_BRANCH }`,
+			...( DEBUG ? [ '-d' ] : [] )
 		],
 
 		/**
@@ -62,8 +70,10 @@ try {
 		[
 			'monitor',
 			'--all-projects',
-			`--exclude=${ values.exclude.join( ',' ) }`,
-			`--target-reference=${ CIRCLE_BRANCH }`
+			`--exclude=${ exclude.join( ',' ) }`,
+			`--detection-depth=${ values.depth }`,
+			`--target-reference=${ CIRCLE_BRANCH }`,
+			...( DEBUG ? [ '-d' ] : [] )
 		],
 
 		/**

package/lib/run-snyk-command.js

@@ -3,6 +3,7 @@
  * For licensing, see LICENSE.md.
  */
 
+import path from 'node:path';
 import { spawn } from 'node:child_process';
 
 /**
@@ -14,10 +15,14 @@ import { spawn } from 'node:child_process';
  * @returns {Promise<void>}
  */
 export default function runSnykCommand( snykArguments, allowedExitCodes = [ 0 ] ) {
+	const snykExecutablePath = path.resolve( import.meta.dirname, '..', 'node_modules', '.bin', 'snyk' );
+	const pnpmFlags = process.env.DEBUG ? [] : [ '--silent' ];
+
 	return new Promise( ( resolve, reject ) => {
-		const childProcess = spawn( 'pnpm', [ '--silent', 'exec', 'snyk', ...snykArguments ], {
+		const childProcess = spawn( 'pnpm', [ ...pnpmFlags, 'exec', snykExecutablePath, ...snykArguments ], {
 			cwd: process.cwd(),
-			stdio: 'inherit'
+			stdio: 'inherit',
+			shell: process.platform === 'win32'
 		} );
 
 		childProcess.on( 'error', reject );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-dev-ci",
-  "version": "54.6.1",
+  "version": "54.7.0",
   "description": "Utils used on various Continuous Integration services.",
   "keywords": [],
   "author": "CKSource (http://cksource.com/)",