snyk-scan.yml

# This workflow sets up Snyk scans

name: Snyk Scan

on:
  push:
    branches: ["main" ]
  pull_request:
    branches: ["main"]
  schedule: # Run snyk scan daily at midnight
    - cron: '0 0 * * *'

permissions:
  contents: read

jobs:
  snyk-python:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master

      - name: Snyk Python report vulnerabilities
        uses: snyk/actions/python@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args:
            --sarif-file-output=snyk.sarif
            --policy-path=.snyk
            --severity-threshold=high # Forces fail on high-severity vulnerabilities

      # Push the Snyk Code results into GitHub Code Scanning tab
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        if: success() || failure()
        with:
          sarif_file: snyk.sarif