sbt-node-snyk-pr.yml

name: Simple Snyk test for SBT + Node

on:
  workflow_call:
    inputs:
      SKIP_NODE:
        type: boolean
        required: false
        default: false
      SKIP_SBT:
        type: boolean
        required: false
        default: false
      SKIP_PYTHON:
        type: boolean
        required: false
        default: true
      SKIP_GO:
        type: boolean
        required: false
        default: true
      DEBUG:
        type: string
        required: false
      SEVERITY_THRESHOLD:
        type: string
        required: false
      ORG:
        type: string
        required: true
      EXCLUDE:
        type: string
        required: false
        default: ""
      JAVA_VERSION:
        type: string
        required: false
        default: "11"
      NODE_VERSION_FILE:
        type: string
        required: false
        default: ".nvmrc"
      NODE_VERSION_OVERRIDE:
        type: string
        required: false
      PRUNE_DUPLICATES:
        type: boolean
        required: false
        default: false
      PYTHON_VERSION:
        type: string
        required: false
      PIP_REQUIREMENTS_FILES:
        type: string
        required: false
        description: space-separated list of requirements.txt file paths to install
      PIPFILES:
        type: string
        required: false
        description: space-separated list of Pipfile file paths to install
      GO_VERSION_FILE:
        type: string
        required: false
        default: go.mod
    secrets:
      SNYK_TOKEN:
        required: true

jobs:
    security:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout branch
              uses: actions/checkout@v4

            - uses: snyk/actions/setup@0.4.0

            - uses: actions/setup-node@v4
              if: inputs.NODE_VERSION_OVERRIDE == '' && inputs.SKIP_NODE != true
              with:
                  node-version-file: ${{ inputs.NODE_VERSION_FILE }}

            - uses: actions/setup-node@v4
              if: inputs.NODE_VERSION_OVERRIDE != '' && inputs.SKIP_NODE != true
              with:
                  node-version: ${{ inputs.NODE_VERSION_OVERRIDE }}

            - uses: actions/setup-java@v4
              if: inputs.SKIP_SBT != true
              with:
                  java-version: ${{ inputs.JAVA_VERSION }}
                  distribution: "adopt"

            - uses: actions/setup-python@v5
              if: inputs.SKIP_PYTHON != true
              with:
                  python-version: ${{ inputs.PYTHON_VERSION }}

            - if: inputs.SKIP_PYTHON != true
              run: pip install pipenv

            - if: inputs.PIP_REQUIREMENTS_FILES != ''
              run: |
                  for file in ${{ inputs.PIP_REQUIREMENTS_FILES }}   
                  do
                    pip install -r $file
                  done

            - if: inputs.PIPFILES != ''
              run: |
                  for file in ${{ inputs.PIPFILES }}   
                  do
                    cd $(echo $file | sed "s/Pipfile//")
                    pipenv install
                    cd -
                  done 

            - uses: actions/setup-go@v5
              if: inputs.SKIP_GO != true
              with:
                  go-version-file: ${{ inputs.GO_VERSION_FILE }}

            - name: Snyk test
              run: |
                snyk test \
                  $DEBUG_OPTION \
                  $PRUNE_OPTION \
                  --severity-threshold=${SEVERITY_THRESHOLD:-high} \
                  --all-projects \
                  --org="${{ inputs.ORG }}" \
                  --exclude="${{ inputs.EXCLUDE }}"
              env:
                  SEVERITY_THRESHOLD: ${{ inputs.SEVERITY_THRESHOLD }}
                  SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
                  DEBUG_OPTION: ${{ inputs.DEBUG == 'true' && '-d' || '' }}
                  PRUNE_OPTION: ${{ inputs.PRUNE_DUPLICATES == true && '-p' || '' }}