contentstack-dotnet/.github/workflows/sca-scan.yml at master · contentstack/contentstack-dotnet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
name: Source Composition Analysis Scan
on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  security-sca:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@master

      - name: Setup .NET Core @ Latest
        uses: actions/setup-dotnet@v1
        with:
          dotnet-version: "7.0.x"

      - name: Run Dotnet Restore
        run: dotnet restore

      - name: Setup Snyk
        uses: snyk/actions/setup@master   # just installs Snyk CLI, no deprecated dotnet action

      - name: Run Snyk to check for vulnerabilities
        run: |
          snyk test \
            --file=Contentstack.Core/obj/project.assets.json \
            --fail-on=all \
            --json-file-output=snyk.json   # ← writes snyk.json to disk
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        continue-on-error: true            # ← let pipeline continue even if vulns found

      - uses: contentstack/sca-policy@main