snyk.yml

name: Snyk
on:
  push:
    branches-ignore:
      - "dependabot/**"
  pull_request:
    branches:
      - "dependabot/**"
jobs:
  golang-snyk:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repositories and submodules
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Run Snyk
        uses: snyk/actions/golang@0.4.0
        continue-on-error: true # To make sure that SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --sarif-file-output=snyk.sarif --all-projects --detection-depth=4

      # Replace any "undefined" security severity values with 0. The undefined value is used in the case
      # of license-related findings, which do not do not indicate a security vulnerability.
      # See https://github.com/github/codeql-action/issues/2187 for more context.
      - name: Post-process sarif output
        run: |
          sed -i 's/"security-severity": "undefined"/"security-severity": "0"/g' snyk.sarif

      - name: Upload result to Github Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif