zxf-snyk-monitor.yaml

##
# Copyright (C) 2023-2024 Hedera Hashgraph, LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
##

name: "ZXF: Snyk Monitor"
# The purpose of this job is to run on each commit to the main branch and daily at midnight UTC on the most recent commit.
# This job is not intended to be run manually, but rather to be run when triggered by either a commit or the schedule.

on:
  push:
    branches:
      - main
  schedule:
    - cron: "0 0 * * 0"

permissions:
  contents: read

env:
  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}

jobs:
  snyk:
    name: Snyk Monitor
    runs-on: solo-linux-medium
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup Java
        uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
        with:
          distribution: temurin
          java-version: 21.0.1

      - name: Setup Gradle
        uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
        with:
          gradle-version: wrapper

      # Node.JS 16.x is required for the Snyk CLI.
      - name: Setup NodeJS
        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version: 16

      # This step may be optional since Snyk analysis does not require the binary artifacts to be built first. However,
      # Snyk will fail if the code does not compile and the error messages are less than helpful. Therefore, we will
      # compile the code first and then run Snyk so that we can get diagnostic information if the code does not compile.
      - name: Compile
        uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
        with:
          gradle-version: wrapper
          arguments: assemble --scan

      - name: Setup Snyk
        run: npm install -g snyk

      # This step is what actually uploads the Snyk analysis to the Snyk Cloud. The Snyk token is stored as a secret
      # in the Github repository and is passed to the Snyk CLI via the environment variable SNYK_TOKEN.
      - name: Run Snyk Monitor
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: snyk monitor --all-projects