auth0__agent-skills/.github/workflows/snyk_agent_scan.yml

name: snyk-agent-scan
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: snyk-agent-scan-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    env:
      UV_PYTHON: "3.12"
      SNYK_AGENT_SCAN_VERSION: "0.5.1"
    steps:
    - name: Checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Install uv
      uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7.1.2
      with:
        python-version: ${{ env.UV_PYTHON }}
        enable-cache: false

    - name: Cache uv tool env
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cache/uv
        key: uv-${{ runner.os }}-py${{ env.UV_PYTHON }}-snyk-agent-scan-${{ env.SNYK_AGENT_SCAN_VERSION }}

    - name: Run snyk-agent-scan on skills
      if: ${{ !cancelled() }}
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      run: |
        set -euo pipefail

        scan_skill() {
          local skill_file="$1"
          local skill_name="$2"

          uvx snyk-agent-scan@${SNYK_AGENT_SCAN_VERSION} "$skill_file" --skills --json 2>/dev/null \
            | tee "snyk-agent-scan-skill-${skill_name}.json" \
            && return 0

          echo "Retrying ${skill_name} in 5s..."
          sleep 5

          uvx snyk-agent-scan@${SNYK_AGENT_SCAN_VERSION} "$skill_file" --skills --json 2>/dev/null \
            | tee "snyk-agent-scan-skill-${skill_name}.json"
        }

        # Scan all skills on both PRs and pushes to main
        SKILL_DIRS=$(find plugins/*/skills -maxdepth 1 -mindepth 1 -type d 2>/dev/null | sort)

        if [ -z "$SKILL_DIRS" ]; then
          echo "No skills to scan"
          echo '{}' > snyk-agent-scan-skills.json
          exit 0
        fi

        echo "Skills to scan:"
        echo "$SKILL_DIRS"

        EXIT_CODE=0
        while IFS= read -r skill_dir; do
          skill_file="${skill_dir}/SKILL.md"
          if [ -f "$skill_file" ]; then
            skill_name=$(echo "$skill_dir" | tr '/' '-')
            echo "Scanning ${skill_dir}..."
            scan_skill "$skill_file" "$skill_name" || EXIT_CODE=1
          else
            echo "Skipping deleted or non-existent skill: ${skill_dir}"
          fi
        done <<< "$SKILL_DIRS"

        exit $EXIT_CODE

    - name: Combine scan results
      if: ${{ !cancelled() }}
      run: cat snyk-agent-scan-*.json > snyk-agent-scan-combined.json 2>/dev/null || true

    - name: Fail on High or Critical findings
      if: ${{ !cancelled() }}
      run: python3 scripts/check_snyk_findings.py

    - name: Upload report artifacts
      if: always()
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: snyk-agent-scan-reports
        path: snyk-agent-scan-*.json
        if-no-files-found: error