name: Dependency Security Scan - Yarn

on:
  pull_request: 
    branches: ['main', 'dev']
    paths: ['ts/**', 'yarn.lock']
  push:
    paths: ['ts/**', 'yarn.lock']

jobs:
  trivy:
    name: Dependency Scan
    runs-on: ubuntu-latest
    if: (github.actor != 'dependabot[bot]')
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      # Report all vulnerabilities in CI output
      - name: Report on all vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: 'yarn.lock'
          ignore-unfixed: true
          hide-progress: true
          format: 'table'
          
      # Fail the job on critical vulnerabiliies with fix available
      - name: Fail on critical vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: 'yarn.lock'
          ignore-unfixed: true
          hide-progress: true
          format: 'table'
          severity: 'CRITICAL'
          exit-code: '1'