collectors-security-pr.yml

name: Run Security Scans PR [snowpark_checkpoints_collector]

on:
  pull_request:
    branches:
      - "**"
    paths:
      - "**"
      - "!snowpark-checkpoints-validators/**"
      - "!snowpark-checkpoints-hypothesis/**"
      - "!Demos/**"

permissions:
  contents: read
  pull-requests: write

env:
  PYTHON_VERSION: "3.11"

jobs:
  snyk:
    runs-on: ubuntu-latest
    if: (github.actor != 'dependabot[bot]')

    steps:
      - name: Check out the repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20.9.0"

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "${{ env.PYTHON_VERSION }}"

      - name: Setup Python environment
        run: |
          python -m pip install --upgrade pip -q
          pip install toml -q
          pip list

      - name: Install Snyk CLI
        run: |
          npm install -g snyk
          echo "Snyk version: $(snyk --version)"

      - name: Authenticate Snyk
        run: |
          snyk auth $SNYK_TOKEN
          snyk config
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_GITHUB_INTEGRATION_TOKEN }}

      - name: Run Python Script Create Requirements
        run: |
          python ./.github/scripts/py_create_requirements.py --directory $DIR_NAME
          cd $DIR_NAME && pwd && ls -la requirements.txt && file requirements.txt
          python -m pip install -r requirements.txt
          pip list
        env:
          DIR_NAME: "snowpark-checkpoints-collectors"

      - name: Run Snyk test
        run: |
          snyk test --all-projects --detection-depth=10 --severity-threshold=high