scan_snyk-jira-integration.yml

name: Snyk Scan and Report

on:
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * *" # daily at 0600 UTC

permissions:
  id-token: write

jobs:
  snyk_run:
    name: Snyk Run (for PR and push)
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Check out repository
        uses: actions/checkout@v2

      - name: Install Snyk and Run Snyk test
        run: |
          npm install -g snyk
          snyk test --all-projects --json > snyk_output.txt || true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  snyk_nightly_run:
    name: Snyk Nightly Run (for nightly cron with JIRA)
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    steps:
      - name: Check out repository
        uses: actions/checkout@v2

      - name: Install Snyk and Run Snyk test
        run: |
          npm install -g snyk
          snyk test --all-projects --json > snyk_output.txt || true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: use the custom github  action to parse Snyk output
        uses: Enterprise-CMCS/macfc-security-scan-report@v2.6.0
        with:
          jira-username: ${{ secrets.JIRA_SERVICE_USERNAME }}
          jira-token: ${{ secrets.JIRA_SERVICE_USER_TOKEN }}
          jira-host: "qmacbis.atlassian.net"
          jira-project-key: "MDCT"
          jira-issue-type: "Task"
          jira-custom-field-key-value: '{ "customfield_10007" : "MDCT-2280", "customfield_14154" : [{"id": "16955", "value": "CARTS"}] }'
          jira-labels: "CARTS,snyk"
          jira-title-prefix: "[CARTS] - Snyk :"
          assign-jira-ticket-to: ${{ secrets.ACCOUNT_ID_REHMAN }}
          scan-output-path: "snyk_output.txt"
          scan-type: "snyk"