snyk.yml

# Use Snyk to find and fix vulnerabilities in your GitHub repository.
# https://github.com/snyk/actions/

name: Snyk Security

on:
  # Allow developers to run this on-demand.
  workflow_dispatch:
  # Scan every Sunday at 1am
  schedule:
    - cron: '0 1 * * SUN'
  # Scan every push to main branch
  push:
    branches:
      - main
  # Scan every pull request to main branch
  pull_request:
    branches:
      - main

permissions:
  contents: read

env:
  # Don't install husky hooks
  # https://typicode.github.io/husky/how-to.html#ci-server-and-docker
  HUSKY: 0

jobs:
  snyk:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status

    runs-on: ubuntu-latest

    steps:
      - name: Checkout source
        uses: actions/checkout@v4

        # Have to setup node twice as workaround until corepack is supported.
        # https://github.com/actions/setup-node/issues/531
      - name: Setup Node (corepack-prereq)
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      - name: Enable corepack (yarn-prereq)
        shell: bash
        run: corepack enable

      - name: Setup Node and Yarn
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: yarn
          cache-dependency-path: yarn.lock

      - name: Install dependencies
        run: yarn install --immutable

      - name: Setup Snyk
        uses: snyk/actions/setup@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Snyk Code Scan
        run: snyk code test --sarif > snyk-code.sarif
        continue-on-error: true # so that the SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Snyk Open Source Monitor
        run: snyk monitor --all-projects
        continue-on-error: true # so that the SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Upload results to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        continue-on-error: true
        with:
          sarif_file: snyk-code.sarif
          category: Snyk