pull-request.snyk.yml

name: "CI"

# This workflow will run after a pull request is opened or updated, assuming the pull request is labeled with "Vetted".

on:
  workflow_run:
    workflows:
      - "Pull Request / Run Checks"
    types:
      - completed

permissions:
  checks: write

jobs:
  snyk:
    name: "Snyk"
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b # pin@2.25.4
        with:
          php-version: ${{ env.PHP_VERSION }}
          coverage: none
          extensions: mbstring
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - run: composer install --no-progress

      - uses: snyk/actions/php@b98d498629f1c368650224d6d212bf7dfa89e4bf # pin@0.4.0
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - uses: actions/github-script@v6
        env:
          parameter_url: '${{ github.event.workflow_run.html_url }}'
        with:
          script: |
            await github.rest.checks.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              head_sha: context.sha,
              name: "Snyk",
              status: "completed",
              conclusion: "${{ github.event.workflow_run.conclusion }}",
              details_url: process.env.parameter_url
            });