snyk.yml

name: Snyk

# On all pushes/PRs.
on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  security:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        requirements: [analysis, coverage]

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

      - name: Set up Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
        with:
          python-version: '3.10'

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18

      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
        with:
          path: ~/.cache/pip
          key: snyk-pip-${{ hashFiles('**/.*-requirements.txt') }}
          restore-keys: snyk-pip-

      - name: Upgrade Pip
        run: pip3 install --upgrade pip
      - name: Install requirements
        env:
          reqs: ${{ matrix.requirements }}
        run: python3 -m pip install -r misc/.$reqs-requirements.txt

      - name: Install Snyk
        run: npm install -g snyk
      - name: Run Snyk
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
          FORCE_COLOR: 2
          SNYK_INTEGRATION_NAME: GITHUB_ACTIONS
          SNYK_INTEGRATION_VERSION: python
          reqs: ${{ matrix.requirements }}
        run: snyk test --project-name=vermin --package-manager=pip --file=misc/.$reqs-requirements.txt --command=python3 --show-vulnerable-paths=all --print-deps