diff --git a/.github/workflows/SnykOpenSourceScans.yaml b/.github/workflows/SnykOpenSourceScans.yaml index a725201feb..8cda59f071 100644 --- a/.github/workflows/SnykOpenSourceScans.yaml +++ b/.github/workflows/SnykOpenSourceScans.yaml @@ -1,12 +1,15 @@ name: Snyk Open Source Scans + concurrency: group: snyk-opensource-actions-${{ github.ref }} cancel-in-progress: true + on: merge_group: types: [checks_requested] pull_request: types: [opened, synchronize, reopened, ready_for_review] + jobs: snyk-opensource-pipeline: runs-on: ubuntu-22.04 @@ -16,43 +19,38 @@ jobs: SNYK_ORG: ${{ vars.SNYK_ORG }} steps: - # Checkout base ref branch - - uses: actions/checkout@v4 - with: - ref: ${{ github.base_ref }} - - uses: actions/setup-python@v5 - with: - python-version: '3.10' -# cache: 'pip' # Uncomment if using requirements.txt -# - run: pip install -r requirements.txt # Uncomment if using requirements.txt - - name: Download Snyk - uses: actions/setup-node@v4 - with: - node-version: 20 - - - name: Install snyk - run: npm install --location=global snyk@latest - - - name: Install snyk-delta # No longer needed -# run: npm install --location=global snyk-delta@latest - -# - name: Install snyk_delta_all_projects.sh # No longer needed -# run: | -# wget -O snyk_delta_all_projects.sh https://raw.githubusercontent.com/snyk-tech-services/snyk-delta/refs/heads/develop/snyk_delta_all_projects.sh -# mv ./snyk_delta_all_projects.sh /usr/local/bin/ - - - name: Install jq - run: npm install --location=global node-jq - - - name: Authenticate Snyk - run: snyk auth ${SNYK_TOKEN} - - - name: Run Snyk Open Source and diff - run: snyk test --org=${SNYK_ORG} --all-projects - -# - name: Run snyk monitor # Uncomment if using snyk/actions/node -# uses: snyk/actions/node@master -# with: -# command: monitor -# args: --all-projects --detection-depth=2 --org=${SNYK_ORG} --severity=high -# run: snyk monitor --all-projects --detection-depth=2 --org=${SNYK_ORG} + # Step 1: Checkout base ref branch + - name: Checkout Base Branch + uses: actions/checkout@v4 + with: + ref: ${{ github.base_ref }} + + # Step 2: Setup Python (optional for additional configurations) + - name: Setup Python Environment + uses: actions/setup-python@v5 + with: + python-version: '3.10' + # Uncomment the following lines if requirements.txt is used + # - run: pip install -r requirements.txt + + # Step 3: Download and Setup Node.js + - name: Setup Node.js Environment + uses: actions/setup-node@v4 + with: + node-version: 20 + + # Step 4: Install Snyk CLI + - name: Install Snyk CLI + run: npm install --location=global snyk@latest + + # Step 5: Install jq + - name: Install jq + run: npm install --location=global node-jq + + # Step 6: Authenticate Snyk + - name: Authenticate with Snyk + run: snyk auth ${{ secrets.SNYK_GH_ACTIONS_TOKEN }} + + # Step 7: Run Snyk Open Source Scan and Diff + - name: Run Snyk Scan + run: snyk test --org=${{ vars.SNYK_ORG }} --all-projects