How to Use Snyk 1.1290.0 to Scan Python 3.13 Dependencies in GitHub Actions 2026-01

name: Snyk Python 3.13 Dependency Scan
on:
  push:
    branches: [ "main", "release/*" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    # Run every Monday at 9am UTC to catch new CVEs
    - cron: '0 9 * * 1'
  workflow_dispatch:

env:
  SNYK_VERSION: "1.1290.0"
  PYTHON_VERSION: "3.13.0"
  DEPENDENCY_FILE: "requirements.txt"

jobs:
  snyk-scan:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write
      pull-requests: write
    steps:
      - name: Checkout repository code
        uses: actions/checkout@v4
        with:
          # Fetch full history to detect dependency changes across commits
          fetch-depth: 0

      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          # Cache pip dependencies to speed up workflow runs
          cache: "pip"
          cache-dependency-path: ${{ env.DEPENDENCY_FILE }}

      - name: Install project dependencies
        run: |
          python -m pip install --upgrade pip
          # Install production and dev dependencies separately for accurate scanning
          pip install -r requirements.txt
          pip install -r requirements-dev.txt || echo "No dev dependencies found, skipping"

      - name: Install Snyk CLI v${{ env.SNYK_VERSION }}
        run: |
          # Download Snyk binary directly to avoid npm registry delays
          curl -L https://github.com/snyk/snyk/releases/download/v${{ env.SNYK_VERSION }}/snyk-linux -o snyk
          chmod +x snyk
          # Verify installed version matches target
          INSTALLED_VERSION=$(./snyk --version | cut -d' ' -f2)
          if [ "$INSTALLED_VERSION" != "${{ env.SNYK_VERSION }}" ]; then
            echo "::error::Installed Snyk version $INSTALLED_VERSION does not match target ${{ env.SNYK_VERSION }}"
            exit 1
          fi

      - name: Authenticate Snyk with API token
        run: ./snyk auth ${{ secrets.SNYK_API_TOKEN }}
        env:
          SNYK_API_TOKEN: ${{ secrets.SNYK_API_TOKEN }}

      - name: Run Snyk dependency scan for Python 3.13
        id: snyk-scan
        run: |
          # Generate SARIF report for GitHub Security tab integration
          ./snyk test \
            --python-version=${{ env.PYTHON_VERSION }} \
            --sarif-file-output=snyk-results.sarif \
            --json-file-output=snyk-results.json \
            --all-projects \
            --detailed
          # Capture exit code to handle vuln findings without failing workflow immediately
          echo "scan_exit_code=$?" >> $GITHUB_OUTPUT
        continue-on-error: true

      - name: Upload Snyk results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: snyk-results.sarif
          wait-for-processing: true

      - name: Fail workflow if critical vulns found
        if: steps.snyk-scan.outputs.scan_exit_code != 0
        run: |
          echo "::error::Critical or high severity vulnerabilities found in dependencies. Check Snyk report."
          # Parse JSON results to count critical vulns for better error messaging
          CRITICAL_COUNT=$(jq '.vulnerabilities | map(select(.severity == "critical")) | length' snyk-results.json)
          echo "::error::Found $CRITICAL_COUNT critical vulnerabilities"
          exit 1

#!/usr/bin/env python3
"""
Generate Snyk configuration file for Python 3.13 projects.
Supports PEP 725 (2023) package metadata format native to Python 3.13.
"""

import json
import os
import sys
import argparse
import logging
from pathlib import Path
from typing import Dict, List, Any

# Configure logging for debug output
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s"
)
logger = logging.getLogger(__name__)

def load_pyproject_toml(project_root: Path) -> Dict[str, Any]:
    """Load and parse pyproject.toml to extract dependency info."""
    pyproject_path = project_root / "pyproject.toml"
    if not pyproject_path.exists():
        logger.warning(f"No pyproject.toml found at {pyproject_path}, falling back to requirements.txt")
        return {}

    try:
        # Use Python 3.13's native tomllib (no third-party deps)
        import tomllib
        with open(pyproject_path, "rb") as f:
            return tomllib.load(f)
    except ImportError:
        logger.error("tomllib not available, upgrade to Python 3.13 to use native TOML parsing")
        sys.exit(1)
    except Exception as e:
        logger.error(f"Failed to parse pyproject.toml: {e}")
        sys.exit(1)

def extract_python_version(pyproject: Dict[str, Any]) -> str:
    """Extract target Python version from pyproject.toml."""
    project_metadata = pyproject.get("project", {})
    requires_python = project_metadata.get("requires-python", ">=3.13")
    # Parse version constraint to get minimum version
    import re
    version_match = re.search(r"(\d+\.\d+\.\d+)", requires_python)
    if version_match:
        return version_match.group(1)
    return "3.13.0"

def generate_snyk_config(project_root: Path, output_path: Path, python_version: str) -> None:
    """Generate .snyk configuration file for Snyk CLI."""
    pyproject = load_pyproject_toml(project_root)
    extracted_version = extract_python_version(pyproject)

    # Use extracted version if newer than provided default
    target_version = python_version if python_version > extracted_version else extracted_version
    logger.info(f"Generating Snyk config for Python {target_version}")

    config = {
        "version": "v1.1290.0",
        "python": {
            "version": target_version,
            "metadata-cache": True,
            "include-zip-deps": True,
            "exclude": [
                "**/tests/**",
                "**/docs/**",
                "**/*.pyc"
            ]
        },
        "scan-settings": {
            "fail-on": ["critical", "high"],
            "ignore-policy": True,
            "report-unresolved": False
        },
        "github-actions": {
            "upload-sarif": True,
            "comment-pr": True
        }
    }

    # Add dependencies from pyproject.toml if available
    dependencies = pyproject.get("project", {}).get("dependencies", [])
    if dependencies:
        config["python"]["pinned-dependencies"] = dependencies
        logger.info(f"Added {len(dependencies)} dependencies from pyproject.toml")

    try:
        with open(output_path, "w") as f:
            json.dump(config, f, indent=2)
        logger.info(f"Successfully wrote Snyk config to {output_path}")
    except Exception as e:
        logger.error(f"Failed to write config file: {e}")
        sys.exit(1)

def main():
    parser = argparse.ArgumentParser(description="Generate Snyk config for Python 3.13 projects")
    parser.add_argument("--project-root", type=Path, default=Path.cwd(), help="Path to project root")
    parser.add_argument("--output", type=Path, default=Path(".snyk"), help="Output path for config file")
    parser.add_argument("--python-version", type=str, default="3.13.0", help="Target Python version")
    args = parser.parse_args()

    if not args.project_root.exists():
        logger.error(f"Project root {args.project_root} does not exist")
        sys.exit(1)

    generate_snyk_config(args.project_root, args.output, args.python_version)

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Debug Snyk 1.1290.0 scan failures for Python 3.13 projects.
Checks common issues: Python version mismatch, missing deps, Snyk auth, network errors.
"""

import os
import sys
import subprocess
import json
import logging
from pathlib import Path
from typing import List, Dict, Optional

logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s"
)
logger = logging.getLogger(__name__)

class SnykDebugger:
    def __init__(self, project_root: Path, snyk_binary: Path = Path("./snyk")):
        self.project_root = project_root
        self.snyk_binary = snyk_binary
        self.issues: List[str] = []
        self.fixes: List[str] = []

    def check_snyk_version(self) -> bool:
        """Verify Snyk binary is version 1.1290.0."""
        if not self.snyk_binary.exists():
            self.issues.append(f"Snyk binary not found at {self.snyk_binary}")
            self.fixes.append("Download Snyk 1.1290.0 from https://github.com/snyk/snyk/releases/tag/v1.1290.0")
            return False

        try:
            result = subprocess.run(
                [str(self.snyk_binary), "--version"],
                capture_output=True,
                text=True,
                check=True
            )
            version = result.stdout.strip().split(" ")[1]
            if version != "1.1290.0":
                self.issues.append(f"Snyk version {version} does not match required 1.1290.0")
                self.fixes.append("Reinstall Snyk 1.1290.0 using the official release binary")
                return False
            logger.info(f"Snyk version check passed: {version}")
            return True
        except Exception as e:
            self.issues.append(f"Failed to run Snyk version check: {e}")
            return False

    def check_python_version(self) -> bool:
        """Verify Python 3.13 is installed and in PATH."""
        try:
            result = subprocess.run(
                ["python3", "--version"],
                capture_output=True,
                text=True,
                check=True
            )
            version = result.stdout.strip().split(" ")[1]
            if not version.startswith("3.13"):
                self.issues.append(f"Python version {version} is not 3.13.x")
                self.fixes.append("Install Python 3.13.0 from https://www.python.org/downloads/release/python-3130/")
                return False
            logger.info(f"Python version check passed: {version}")
            return True
        except Exception as e:
            self.issues.append(f"Failed to check Python version: {e}")
            return False

    def check_dependency_file(self) -> bool:
        """Check if dependency file exists and is readable."""
        dep_files = ["requirements.txt", "pyproject.toml", "Pipfile"]
        found = False
        for dep_file in dep_files:
            if (self.project_root / dep_file).exists():
                logger.info(f"Found dependency file: {dep_file}")
                found = True
                break
        if not found:
            self.issues.append("No dependency file found (requirements.txt, pyproject.toml, Pipfile)")
            self.fixes.append("Create a requirements.txt or pyproject.toml with your project dependencies")
            return False
        return True

    def check_snyk_auth(self) -> bool:
        """Verify Snyk is authenticated with valid API token."""
        try:
            result = subprocess.run(
                [str(self.snyk_binary), "config", "get", "api"],
                capture_output=True,
                text=True
            )
            if "not authenticated" in result.stderr.lower():
                self.issues.append("Snyk is not authenticated")
                self.fixes.append("Run snyk auth  with a valid Snyk API token")
                return False
            logger.info("Snyk authentication check passed")
            return True
        except Exception as e:
            self.issues.append(f"Failed to check Snyk auth: {e}")
            return False

    def run_test_scan(self) -> bool:
        """Run a test Snyk scan to catch runtime errors."""
        try:
            result = subprocess.run(
                [str(self.snyk_binary), "test", "--python-version=3.13", "--json"],
                capture_output=True,
                text=True,
                cwd=self.project_root
            )
            # Snyk returns non-zero exit code if vulns found, which is not an error here
            if result.returncode not in (0, 1):
                self.issues.append(f"Test scan failed with exit code {result.returncode}: {result.stderr}")
                self.fixes.append("Check Snyk logs for detailed error messages")
                return False
            logger.info("Test scan completed successfully")
            return True
        except Exception as e:
            self.issues.append(f"Failed to run test scan: {e}")
            return False

    def print_report(self):
        """Print debug report with issues and fixes."""
        print("\n" + "="*80)
        print("SNYK SCAN DEBUG REPORT")
        print("="*80)
        if not self.issues:
            print("No issues found. Snyk scan should run successfully.")
        else:
            print(f"Found {len(self.issues)} issue(s):\n")
            for i, issue in enumerate(self.issues, 1):
                print(f"{i}. {issue}")
            print("\nRecommended fixes:\n")
            for i, fix in enumerate(self.fixes, 1):
                print(f"{i}. {fix}")
        print("="*80 + "\n")

def main():
    parser = argparse.ArgumentParser(description="Debug Snyk scan failures for Python 3.13")
    parser.add_argument("--project-root", type=Path, default=Path.cwd(), help="Path to project root")
    parser.add_argument("--snyk-binary", type=Path, default=Path("./snyk"), help="Path to Snyk binary")
    args = parser.parse_args()

    debugger = SnykDebugger(args.project_root, args.snyk_binary)
    debugger.check_snyk_version()
    debugger.check_python_version()
    debugger.check_dependency_file()
    debugger.check_snyk_auth()
    debugger.run_test_scan()
    debugger.print_report()

if __name__ == "__main__":
    main()

./snyk test \
  --python-version=3.13 \
  --python-metadata-cache \
  --sarif-file-output=snyk.sarif

./snyk ignore \
  --id=SNYK-PYTHON-REQUESTS-6928867 \
  --reason="Dev only dependency, not shipped to production"

- name: Upload Snyk results to GitHub Security
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: snyk-results.sarif

python-3.13-snyk-scan-example/
├── .github/
│   └── workflows/
│       └── snyk-scan.yml       # GitHub Actions workflow from Code Example 1
├── requirements.txt            # Production dependencies
├── requirements-dev.txt        # Dev dependencies
├── pyproject.toml              # Python 3.13 project metadata
├── generate_snyk_config.py     # Code Example 2: Config generator
├── debug_snyk_scan.py          # Code Example 3: Troubleshooting script
└── README.md                   # Tutorial documentation