snyk-push.yml

name: Run Snyk monitor on push

on:
  push:
    branches:
      - master**
  workflow_call:
    inputs:
      github_ref:
        required: true
        type: string

jobs:
  run-snyk-monitor:
    runs-on: ubuntu-latest

    steps:
      - name: Select GitHub ref
        id: select_github_ref
        shell: bash
        run: |
          workflow_call_github_ref=${{ inputs.github_ref }}
          echo "selected_github_ref=${workflow_call_github_ref:-${{ github.ref_name }}}" >> "$GITHUB_OUTPUT"

      - name: Setup Java
        uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4
        with:
          distribution: 'temurin'
          java-version: |
            8
            11

      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
        with:
          path: mqtt-cli
          ref: ${{ steps.select_github_ref.outputs.selected_github_ref }}

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk monitor
        shell: bash
        run: >
          snyk monitor --configuration-matching=^runtimeClasspath$ --target-reference=${{ steps.select_github_ref.outputs.selected_github_ref }} --org=hivemq-mqtt-cli
          --project-name=mqtt-cli --remote-repo-url=mqtt-cli --project-lifecycle=development mqtt-cli -d
          --project-tags=kanbanize_board_name="\"Tooling++&++Extension,kanbanize_board_workflow_name=Development++Workflow,kanbanize_board_column_name=Selected,kanbanize_board_swimlane=Expedite,kanbanize_board_done_sections=4/5\""
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}