security-scans.yml

name: RAGStack Security Scan

on:
  workflow_dispatch: {}
  schedule:
    - cron: '0 * * * *'
# might be a good idea to run this on every PR, but it's a bit too noisy since we cannot actually fix the vulnerabilities sometimes but we don't want to ignore them as well
#  pull_request:
#    branches:
#      - main

jobs:
  snyk:
    name: Run Snyk scan
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repo
        uses: actions/checkout@v3
      - name: Run Snyk to check for vulnerabilities
        id: snyk
        uses: ./.github/actions/snyk-python-3.11
        with:
          token: ${{ secrets.SNYK_TOKEN }}
      - uses: actions/setup-python@v4
        with:
          python-version: '3.x'
      - name: Process Snyk report
        if: always()
        run: python ./scripts/parse-snyk-report.py snyk-vuln.json snyk-report.txt

      - name: Prepare report for Slack
        if: always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
        uses: ./.github/actions/generate-slack-report
        with:
          from-report-file: snyk-report.txt
          output-file: slack-report.json
          type: "RAGStack Security Scan"
          outcome: ${{ steps.snyk.outcome }}
          commit-url: "https://github.com/datastax/ragstack-ai/commits/${{ steps.commit-ref.outputs.commit-ref }}"
      - name: Dump report on Slack
        if: always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload-file-path: "./slack-report.json"
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}