name: Security scanning
on:
  push:
    tags:
      - v*
    branches:
      - master
      - release-*

permissions:
  contents: read

jobs:
  security:
    if: github.repository == 'rook/rook'
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: run Snyk to check for code vulnerabilities
        uses: snyk/actions/golang@86b1cee1b8e110a78d528b3e1328a80e218111d2 # master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
          GOFLAGS: "-buildvcs=false"