snyk-monitor.yml

name: Snyk Monitor
on:
  push:
    branches:
      - "main"
      - "release/**"
    tags:
      - "v*"

defaults:
  run:
    shell: bash

permissions:
  contents: read

env:
  LC_ALL: C.UTF-8

jobs:
  snyk-monitor:
    name: Snyk Monitor
    runs-on: mirror-node-linux-large
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Node
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 21

      - name: Install JDK
        uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
        with:
          distribution: "temurin"
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@cc4fc85e6b35bafd578d5ffbc76a5518407e1af0 # v4

      - name: Execute Snyk Monitor
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: ./gradlew snyk-monitor