This repository was archived by the owner on May 22, 2026. It is now read-only.

Repository navigation

ci: scan uv dependencies through generated requirements #102

	name: Python Snyk Scan

	on:
	push:
	paths:
	- app_python/**
	- .github/actions/python-setup/**
	- .github/workflows/python-snyk.yml
	pull_request:
	branches:
	- master
	paths:
	- app_python/**
	- .github/actions/python-setup/**
	- .github/workflows/python-snyk.yml

	jobs:
	snyk:
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: ./app_python
	steps:
	- uses: actions/checkout@v6
	- name: Setup Python tooling and dependencies
	uses: ./.github/actions/python-setup
	with:
	uv-version: 0.11.14
	install-args: --locked --no-dev
	- name: Setup Snyk CLI
	uses: snyk/actions/setup@master
	- name: Verify Snyk requirements export
	run: \|
	uv export \
	--locked \
	--no-dev \
	--no-annotate \
	--no-header \
	--no-hashes \
	--format requirements.txt \
	--output-file /tmp/snyk-requirements.txt \
	> /dev/null
	diff -u requirements.txt /tmp/snyk-requirements.txt
	- name: Prepare Snyk scan environment
	run: \|
	uv venv --seed .snyk-venv
	uv pip install --python .snyk-venv/bin/python -r requirements.txt
	- name: Run Snyk dependency scan
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
	run: \|
	if [ -z "${SNYK_TOKEN:-}" ]; then
	echo "SNYK_TOKEN secret not set; skipping Snyk dependency scan."
	exit 0
	fi
	snyk test \
	--file=requirements.txt \
	--package-manager=pip \
	--command=.snyk-venv/bin/python \
	--severity-threshold=medium \
	--fail-on=upgradable