From 70d700aadda5d30811d3317ec5eedf69c9da1d30 Mon Sep 17 00:00:00 2001
From: Aravind Kumar <aravind.kumar@contentstack.com>
Date: Sun, 2 Aug 2026 17:45:59 +0530
Subject: [PATCH] sca-scan.yml

---
 .github/workflows/sca-scan.yml | 31 +++++++++----------------------
 1 file changed, 9 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml
index 274c89b..b76d356 100644
--- a/.github/workflows/sca-scan.yml
+++ b/.github/workflows/sca-scan.yml
@@ -2,33 +2,20 @@ name: Source Composition Analysis Scan
 on:
   pull_request:
     types: [opened, synchronize, reopened]
-
 jobs:
   security-sca:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@master
-
-      - name: Setup .NET Core @ Latest
-        uses: actions/setup-dotnet@v1
-        with:
-          dotnet-version: "10.0.x"
-
-      - name: Run Dotnet Restore
-        run: dotnet restore
-
-      - name: Setup Snyk
-        uses: snyk/actions/setup@master   # just installs Snyk CLI, no deprecated dotnet action
-
+      - uses: actions/checkout@master
       - name: Run Snyk to check for vulnerabilities
-        run: |
-          snyk test \
-            --file=Contentstack.Core/obj/project.assets.json \
-            --fail-on=all \
-            --json-file-output=snyk.json   # ← writes snyk.json to disk
+        uses: snyk/actions/dotnet@master
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        continue-on-error: true            # ← let pipeline continue even if vulns found
-
+        with:
+          args: --fail-on=all
+          json: true
+        continue-on-error: true
       - uses: contentstack/sca-policy@main