snyk-checks.yml

name: Scan project with Snyk for vulnerabilities
on:
  pull_request:
    branches:
      - master
    types:
      - opened
      - reopened
      - synchronize
  workflow_dispatch:
  schedule:
    - cron: "0 9 * * 1"
jobs:
  dependencies:
    runs-on: ubuntu-latest
    if: ${{ github.actor != 'dependabot[bot]' }}
    steps:
      - uses: actions/checkout@master
      - name: Run Snyk for vulnerabilities
        uses: snyk/actions/python-3.9@master
        continue-on-error: true # To make sure that SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --sarif-file-output=snyk.sarif
          command: test
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: snyk.sarif
  code:
    runs-on: ubuntu-latest
    if: ${{ github.actor != 'dependabot[bot]' }}
    steps:
      - uses: actions/checkout@master
      - name: Run Snyk for static code check
        uses: snyk/actions/python-3.9@master
        continue-on-error: true # To make sure that SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --sarif-file-output=static-snyk.sarif
          command: code test
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: static-snyk.sarif