Update snyk-security.yml

Signed-off-by: David Osipov <[email protected]>

Author: DavidOsipov

.github/workflows/snyk-security.yml

@@ -35,21 +35,31 @@ jobs:
       actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Set up Snyk CLI to check for security issues
         # Snyk can be used to break the build when it detects security issues.
         # In this case we want to upload the SAST issues to GitHub Code Scanning
         uses: snyk/actions/setup@cdb760004ba9ea4d525f2e043745dfe85bb9077e
 
-        # For Snyk Open Source you must first set up the development environment for your application's dependencies
-        # For example for Node
-        #- uses: actions/setup-node@v4
-        #  with:
-        #    node-version: 20
+      - name: Set up Python
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38
+        with:
+          python-version: '3.12.7'
+          
+      - name: Install dependencies
+        run: |
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          if [ -f Pipfile ]; then pip install pipenv && pipenv install --dev; fi
+          if [ -f pyproject.toml ]; then pip install poetry && poetry install; fi
 
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/python-3.10@4a528b5c534bb771b6e3772656a8e0e9dc902f8b
+        continue-on-error: true # To make sure that SARIF upload gets called
         env:
-          # This is where you will need to introduce the Snyk API token created with your Snyk account
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+          SNYK_TOKEN: ${{ secrets.SNYK_SECRET_TOKEN }}
+        with:
+          args: --sarif-file-output=snyk.sarif --severity-threshold=medium
+         
 
         # Runs Snyk Code (SAST) analysis and uploads result into GitHub.
         # Use || true to not fail the pipeline