snyk-pr.yml

name: Snyk PR
on:
  pull_request:
    branches:
      - main

permissions:
  contents: read
  issues: write
  pull-requests: write

jobs:
  snyk:
    runs-on: ubuntu-latest
    if: ${{ github.event.pull_request.user.login == 'sfc-gh-snyk-sca-sa' }}
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        persist-credentials: false
        ref: ${{ github.event.pull_request.head.ref }}
        fetch-depth: 0

    - name: Checkout Action
      uses: actions/checkout@v4
      with:
        persist-credentials: false
        repository: snowflakedb/whitesource-actions
        token: ${{ secrets.whitesource_action_token }}
        path: whitesource-actions

    - name: Snyk Pull Request Scan Check
      uses: ./whitesource-actions/snyk-pr
      env:
        pr_title: ${{ github.event.pull_request.title }}
      with:
        jira_token: ${{ secrets.jira_token_public_repo }}
        gh_token: ${{ secrets.github_token }}
        amend: false