name: Snyk Test
on:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * *"

permissions:
  contents: read

jobs:
  test-snyk:
    name: Run Snyk
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' || (github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node environment
        uses: ./.github/workflows/actions/setup-node-environment

      - name: Run Snyk Test
        shell: bash
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          pnpm run snyk-test

      - name: Upload Snyk Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: Snyk Report - ${{ github.run_id }}
          path: |
            .sbom/snyk-test-result.html
            .sbom/snyk-test-result.json

      - name: Generate Vulnerability Report (Fail on >= High)
        continue-on-error: ${{ github.event_name == 'pull_request' }}
        shell: bash
        run: |
          pnpm run generate-vulnerability-report > /dev/null
