sample_workflow.yaml

---
name: vanagon check PRs

on:
  push:
    branches:
      - main

jobs:
 snyk_vanagon:
   runs-on: ubuntu-latest
   steps:
    - name: checkout the current PR
      uses: actions/checkout@v2
      with:
        fetch-depth: 0
        persist-credentials: false
    - name: Run Vanagon Snyk Scan
      uses: puppetlabs/security-snyk-vanagon-action@v2.2.0
      with:
        snykToken: ${{ secrets.SNYK_TOKEN }}
        snykOrg: 'sectest'
        skipProjects: 'agent-runtime-5.5.x,agent-runtime-1.10.x,client-tools-runtime-irving,pdk-runtime'
        skipPlatforms: 'cisco-wrlinux-5-x86_64,cisco-wrlinux-7-x86_64,debian-10-armhf,eos-4-i386,fedora-30-x86_64,fedora-31-x86_64,osx-10.14-x86_64'
        urlsToReplace: 'artifactory.delivery.puppetlabs.net,%s/xart,builds.delivery.puppetlabs.net,%s/xbuild'
        newHost: 'localhost'
        rproxyUser: '${{ secrets.RPROXY_USER }}'
        rproxyKey: '${{ secrets.RPROXY_KEY }}'
        sshKey: '${{ secrets.SSH_KEY }}'
        sshKeyName: 'id_ed25519'
        branch : {{ github.ref_name }}
    - name: Check output
      if: steps.scan.outputs.vulns != ''
      run: echo "Vulnerabilities detected; ${{ steps.scan.outputs.vulns }}" && exit 1