Snyk #240

	name: Snyk

	on:
	merge_group:
	pull_request_target:
	types:
	- opened
	- synchronize
	push:
	branches:
	- master
	schedule:
	- cron: "30 0 1,15 * *"

	permissions:
	security-events: write
	actions: read
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

	jobs:
	authorize:
	name: Authorize
	environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' \|\| 'internal' }}
	runs-on: ubuntu-latest
	steps:
	- run: true

	check:
	needs: authorize

	name: Check for Vulnerabilities
	runs-on: ubuntu-latest

	steps:
	- if: github.actor == 'dependabot[bot]' \|\| github.event_name == 'merge_group'
	run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.

	- uses: actions/checkout@v4
	with:
	ref: ${{ github.event.pull_request.head.sha \|\| github.ref }}

	- uses: snyk/actions/python-3.7@b98d498629f1c368650224d6d212bf7dfa89e4bf # pin@0.4.0
	continue-on-error: true # Make sure the SARIF upload is called
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
	with:
	args: --sarif-file-output=snyk.sarif

	- name: Upload result to GitHub Code Scanning
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: snyk.sarif

Provide feedback