zxf-snyk-monitor.yaml

##
# Copyright (C) 2023 Hedera Hashgraph, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##

name: "ZXF: Snyk Monitor"
# The purpose of this job is to run on each commit to the main branch and daily at midnight UTC on the most recent commit.
# This job is not intended to be run manually, but rather to be run when triggered by either a commit or the schedule.

on:
  push:
    branches:
      - main
  schedule:
    - cron: "0 0 * * 0"

permissions:
  contents: read

jobs:
  snyk:
    name: Snyk Monitor
    runs-on: [self-hosted, Linux, medium, ephemeral]
    steps:
      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

      - name: Setup Java
        uses: actions/setup-java@cd89f46ac9d01407894225f350157564c9c7cee2 # v3.12.0
        with:
          distribution: temurin
          java-version: 17.0.7

      - name: Setup Gradle
        uses: gradle/gradle-build-action@243af859f8ca30903d9d7f7936897ca0358ba691 # v2.7.1
        with:
          gradle-version: wrapper

      # Node.JS 16.x is required for the Snyk CLI.
      - name: Setup NodeJS
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: 16

      # This step may be optional since Snyk analysis does not require the binary artifacts to be built first. However,
      # Snyk will fail if the code does not compile and the error messages are less than helpful. Therefore, we will
      # compile the code first and then run Snyk so that we can get diagnostic information if the code does not compile.
      - name: Compile
        uses: gradle/gradle-build-action@243af859f8ca30903d9d7f7936897ca0358ba691 # v2.7.1
        with:
          gradle-version: wrapper
          arguments: assemble --scan

      - name: Setup Snyk
        run: npm install -g snyk

      # This step is what actually uploads the Snyk analysis to the Snyk Cloud. The Snyk token is stored as a secret
      # in the Github repository and is passed to the Snyk CLI via the environment variable SNYK_TOKEN.
      - name: Run Snyk Monitor
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: snyk monitor --all-sub-projects