pr_and_main.yml

name: "Snyk scan"

on:
  pull_request:
  push:
    branches:
      - main

jobs:

  snyk_scan_deps_licences:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Run Snyk to check for deps vulnerabilities
        uses: snyk/actions/gradle-jdk17@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        with:
          args: --all-projects --org=${{ secrets.SNYK_ORG_ID }} --severity-threshold=high
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  snyk_scan_code:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Run Snyk to check for code vulnerabilities
        uses: snyk/actions/gradle-jdk17@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        with:
          args: --all-projects --org=${{ secrets.SNYK_ORG_ID }} --severity-threshold=high
          command: code test
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  snyk_sbom:
    runs-on: ubuntu-latest
    needs:
      - snyk_scan_deps_licences
      - snyk_scan_code
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Generate SBOM # check SBOM can be generated but nothing is done with it
        uses: snyk/actions/gradle-jdk17@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        with:
          args: --all-projects --org=${{ secrets.SNYK_ORG_ID }} --format=cyclonedx1.4+json --json-file-output sbom.json
          command: sbom
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  snyk_online_monitor:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Enable Snyk online monitoring to check for vulnerabilities
        uses: snyk/actions/gradle-jdk17@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        with:
          args: --all-projects --org=${{ secrets.SNYK_ORG_ID }}
          command: monitor
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}