opened
chris-macdermaid
username_0
## User Story

As a person in the O&M role, I want a GitHub Action or Snyk integration to open issues for vulnerabilities.

## Acceptance Criteria
- [ ] Research Snyk GitHub integration
- [ ] Research GitHub Actions
- [ ] Test possible solutions with with inventory-app

## Security Considerations ([required](https://nvd.nist.gov/800-53/Rev4/control/CM-4))
No security concerns. This a research ticket.

## Sketch
One potential solution is the [Snyk GitHub Issue Creator](https://github.com/elastic/snyk-github-issue-creator)

The Snyk GitHub integration documentation is [here](https://support.snyk.io/hc/en-us/articles/360004032117-GitHub-integration)
[research: 1d] Identify GH action or Snyk integration that Opens Issues
issue
created
jbrown-xentity
username_1
We could consider making a github action that runs on dependabot/snyk pr's to run the make update-dependencies command on a PR so that all dependencies are synced and up to date.
This would involve deactivating all PR's for the full `requirements.txt` file, which is a simple UI fix.
Will need to set some [configuration options](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
comment
created
mogul
username_2
This looks like a handy alternative that explicitly calls out the things we've said are problems.
https://github.com/apps/renovate
comment