snyk.yaml

name: Snyk

on:
  workflow_dispatch:

  schedule:
    - cron: "0 9 * * 1"  # runs each Monday at 9:00 UTC

permissions:
  contents: read
  security-events: write

jobs:
  security:
    strategy:
      matrix:
        python-version: [3.9]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install All Requirements
        run: |
          python -m venv .venv
          source .venv/bin/activate
          make install
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/python-3.9@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --command=.venv/bin/python3.9 --all-projects --detection-depth=5 --severity-threshold=high --package-manager=pip