snyk-scan.yml

name: Snyk

on:
  push:
    branches: [ main ]
    paths:
      - '**gradle**' # build.gradle.kts, settings.gradle.kts, gradle.properties, etc.
      - '**snyk**' # .snyk, snyk-scan.yml
  pull_request:
    branches: [ main ]
    paths:
      - '**gradle**'
      - '**snyk**'
  schedule:
    - cron:  '0 17 * * 2' # 17:00 UTC (9am/10am Pacific) every Tuesday

jobs:
  snyk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Download and configure Snyk CLI
        run: |
          curl -Lo ./snyk https://github.com/snyk/snyk/releases/latest/download/snyk-linux
          chmod 755 snyk
      - name: Execute scan
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          ./snyk test                      \
            --severity-threshold=medium    \
            --all-projects                 \
            --policy-path=.                \
            --sarif-file-output=snyk.sarif
      - name: Upload scan
        if: ${{ failure() && github.event_name == 'schedule' }}
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: snyk.sarif