<commit_before>name: Snyk Security Vulnerability Scan

on:
  pull_request:
  push:
    branches:
      - 'master'
      - 'rel-*'
      - 'devops/snyk-security-scan-integration'

jobs:
  snyk_scan_test:
    #if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
        with:
          fetch-depth: 0 # To fetch all commits history on branch (Refer: https://github.com/tj-actions/changed-files#usage)
       
      - name: Check changed Deps files
        uses: tj-actions/changed-files@v10
        id: changed-files
        with:
          files: | # This will match all the files with below patterns
            build.gradle$
            requirements.txt$
            package.json$

      - uses: snyk/actions/setup@master

      - uses: actions/setup-java@v1
        with:
          java-version: "8"
          distribution: 'adopt'
      - name: Snyk scan for Java dependencies 
        #if: contains(steps.changed-files.outputs.all_changed_and_modified_files, 'build.gradle')
        id: scan1
        continue-on-error: true
        run: |
          unset CI # By default GH actions will set it to true. Therfore it will affect isCi flag in build.gradle (line #7)
          snyk test --all-sub-projects -d --fail-on=all --package-manager=gradle
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - uses: actions/setup-python@v1
        with:
          python-version: "3.6"
      - name: Snyk scan for Python 3.6 dependencies
        #if: contains(steps.changed-files.outputs.all_changed_and_modified_files, 'requirements.txt')
        id: scan2
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          sudo apt-get install -y libkrb5-dev
          pip install -r h2o-py/requirements.txt            
          snyk test -d --fail-on=all --file=h2o-py/requirements.txt --package-manager=pip --command=python3 --skip-unresolved   

      - uses: actions/setup-node@v1
        with:
          node-version: '12.x'
      - name: Snyk scan for Node dependencies
        #if: contains(steps.changed-files.outputs.all_changed_and_modified_files, 'package.json')
        id: scan3
        continue-on-error: true
        run: |
          snyk test --file=h2o-web/package.json -d --fail-on=all 
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Check Snyk scan results
        if: steps.scan1.outcome == 'failure' || steps.scan2.outcome == 'failure' || steps.scan3.outcome == 'failure' || steps.scan4.outcome == 'failure'
        shell: bash
        run: |
          echo "[warning] Please solve the fixable security vulnerabilities found in failed steps!
                Snyk scan for Java dependencies - ${{ steps.scan1.outcome }}
                Snyk scan for Python 3.5 dependencies - ${{ steps.scan2.outputs.outcome }}
                Snyk scan for Node dependencies - ${{ steps.scan3.outputs.outcome }}"
          exit 1<commit_msg>Update check status result<commit_after>name: Snyk Security Vulnerability Scan

on:
  pull_request:
  push:
    branches:
      - 'master'
      - 'rel-*'
      - 'devops/snyk-security-scan-integration'

jobs:
  snyk_scan_test:
    #if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
        with:
          fetch-depth: 0 # To fetch all commits history on branch (Refer: https://github.com/tj-actions/changed-files#usage)
       
      - name: Check changed Deps files
        uses: tj-actions/changed-files@v10
        id: changed-files
        with:
          files: | # This will match all the files with below patterns
            build.gradle$
            requirements.txt$
            package.json$

      - uses: snyk/actions/setup@master

      - uses: actions/setup-java@v1
        with:
          java-version: "8"
          distribution: 'adopt'
      - name: Snyk scan for Java dependencies 
        #if: contains(steps.changed-files.outputs.all_changed_and_modified_files, 'build.gradle')
        id: scan1
        continue-on-error: true
        run: |
          unset CI # By default GH actions will set it to true. Therfore it will affect isCi flag in build.gradle (line #7)
          snyk test --all-sub-projects -d --fail-on=all --package-manager=gradle
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - uses: actions/setup-python@v1
        with:
          python-version: "3.6"
      - name: Snyk scan for Python 3.6 dependencies
        #if: contains(steps.changed-files.outputs.all_changed_and_modified_files, 'requirements.txt')
        id: scan2
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          sudo apt-get install -y libkrb5-dev
          pip install -r h2o-py/requirements.txt            
          snyk test -d --fail-on=all --file=h2o-py/requirements.txt --package-manager=pip --command=python3 --skip-unresolved   

      - uses: actions/setup-node@v1
        with:
          node-version: '12.x'
      - name: Snyk scan for Node dependencies
        #if: contains(steps.changed-files.outputs.all_changed_and_modified_files, 'package.json')
        id: scan3
        continue-on-error: true
        run: |
          snyk test --file=h2o-web/package.json -d --fail-on=all 
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Check Snyk scan results
        if: steps.scan1.outcome == 'failure' || steps.scan2.outcome == 'failure' || steps.scan3.outcome == 'failure' || steps.scan4.outcome == 'failure'
        shell: bash
        run: |
          echo "[warning] Please solve the fixable security vulnerabilities found in failed steps!
                Snyk scan for Java dependencies - ${{ steps.scan1.outcome }}
                Snyk scan for Python 3.5 dependencies - ${{ steps.scan2.outcome }}
                Snyk scan for Node dependencies - ${{ steps.scan3.outcome }}"
          exit 1
{'fraction_non_alphanumeric': 0.10976218193913188, 'fraction_numerical': 0.010643605521370364, 'mean_word_length': 2.007, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '753678', 'n_tokens_mistral': 1904, 'n_tokens_neox': 1835, 'n_words': 456}