name: Integration Tests Snyk Scan
on: push
jobs:
  security:
    name: Integration Tests Snyk Scan
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    env:
      working-directory: ./integration-test/
    steps:
      - name: CheckOut
        uses: actions/checkout@v5
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17
      - name: Cache local Maven repository
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Configure Git user
        run: |
          git config --global user.email jenkins@pluto.tv
          git config --global user.name JenkinsPTV

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Snyk Test
        run: snyk test --severity-threshold=high -- -s settings.xml -Dmtvi_nexus_username="${{ secrets.MTVI_NEXUS_USERID }}" -Dmtvi_nexus_password="${{ secrets.MTVI_NEXUS_PASSWORD }}"
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        working-directory: ./integration-test/