snyk-code.yml

name: Snyk Code Scan

on:
  workflow_dispatch:

jobs:
  snyk-code:
    name: SAST Scan
    runs-on: codebuild-semoss-github-runner-${{ github.run_id }}-${{ github.run_attempt }}
    container:
      image: quay.io/semoss/test-quay:ubuntu-dind
    permissions:
      contents: read
      security-events: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk Code scan
        run: snyk code test --org=semoss --sarif-file-output=snyk-code.sarif
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        continue-on-error: true

      - name: Check SARIF output exists
        id: sarif-check
        run: test -f snyk-code.sarif && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT

      - name: Upload SARIF to GitHub Security tab
        if: steps.sarif-check.outputs.exists == 'true'
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: snyk-code.sarif