snyk-security.yml

name: Snyk Security

on:
  push:
    branches: ["master"]
  pull_request:
    branches: ["master"]

permissions:
  contents: read

jobs:
  snyk:
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.1' # Specify the PHP version

      - name: Install PHP dependencies
        run: composer install

      - name: Install core node_modules
        run: yarn install --immutable

      - name: Set up Snyk CLI to check for security issues
        uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Snyk Code test
        run: snyk code test --sarif > snyk-code.sarif # || true

      - name: Snyk Open Source test
        run: snyk test --severity-threshold=high --all-projects

      - name: Snyk Open Source monitor
        run: snyk monitor --all-projects

      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk-code.sarif