snyk.yaml

name: Snyk test
on:
  pull_request:
    branches:
      - master
      - dev

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: snyk/actions/setup@master
        with:
          snyk-version: v1.1032.0

      - uses: actions/setup-java@v3
        with:
          distribution: temurin
          java-version: 17

      - name: Decrypt libraries
        run: ./.github/scripts/decrypt_libraries.sh
        env:
          E4LINK_PASSPHRASE: ${{ secrets.E4LINK_PASSPHRASE }}

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Run Snyk to check for vulnerabilities
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: >
          snyk test
          --all-sub-projects
          --configuration-matching="^runtimeClasspath$"
          --fail-on=upgradable
          --org=radar-base
          --policy-path=.snyk
          --severity-threshold=high