synk.yml

name: CI with Snyk

on:
  push:
    branches:
      - main
      - feature/**
  pull_request:
    branches:
      - main
      - feature/**

jobs:
  snyk:
    name: Snyk Vulnerability Check
    runs-on: ubuntu-latest

    steps:
      # Checkout the code from the repository
      - name: Checkout code
        uses: actions/checkout@v3

      # Set up JDK 11 using setup-java v3
      - name: Set up JDK 11
        uses: actions/setup-java@v3
        with:
          java-version: '11'
          distribution: 'temurin' # You can also use 'zulu', 'adopt', or 'oracle'

      # Set JAVA_HOME environment variable
      - name: Set JAVA_HOME
        run: echo "JAVA_HOME=${{ steps.setup-java.outputs.java-home }}" >> $GITHUB_ENV

      # Install Snyk CLI
      - name: Install Snyk CLI
        run: npm install -g snyk

      # Run Snyk to test for vulnerabilities
      - name: Run Snyk Test
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} # Use the Snyk token
          SNYK_API: "https://app.snyk.io/api"
          JAVA_HOME: ${{ steps.setup-java.outputs.java-home }} # Set JAVA_HOME explicitly
        run: snyk test --severity-threshold=high --exit-code=0 --all-projects
        continue-on-error: true

      # Optionally monitor the project with Snyk
      - name: Monitor with Snyk
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
          SNYK_API: "https://app.snyk.io/api"
          JAVA_HOME: ${{ steps.setup-java.outputs.java-home }} # Set JAVA_HOME explicitly
        run: snyk monitor --severity-threshold=high --exit-code=0 --all-projects
        continue-on-error: true