From 180329f72bd1c9ac349448f6b11f0a053bd6baaf Mon Sep 17 00:00:00 2001
From: Aravind Kumar <aravind.kumar@contentstack.com>
Date: Mon, 3 Aug 2026 14:59:40 +0530
Subject: [PATCH] Update sca-scan.yml

---
 .github/workflows/sca-scan.yml | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml
index b76d356..d6216c4 100644
--- a/.github/workflows/sca-scan.yml
+++ b/.github/workflows/sca-scan.yml
@@ -2,6 +2,7 @@ name: Source Composition Analysis Scan
 on:
   pull_request:
     types: [opened, synchronize, reopened]
+
 jobs:
   security-sca:
     runs-on: ubuntu-latest
@@ -9,13 +10,28 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@master
+      - name: Checkout repository
+        uses: actions/checkout@master
+
+      - name: Setup .NET Core @ Latest
+        uses: actions/setup-dotnet@v1
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Run Dotnet Restore
+        run: dotnet restore
+
+      - name: Setup Snyk
+        uses: snyk/actions/setup@master   # just installs Snyk CLI, no deprecated dotnet action
+
       - name: Run Snyk to check for vulnerabilities
-        uses: snyk/actions/dotnet@master
+        run: |
+          snyk test \
+            --file=Contentstack.Core/obj/project.assets.json \
+            --fail-on=all \
+            --json-file-output=snyk.json   # ← writes snyk.json to disk
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          args: --fail-on=all
-          json: true
-        continue-on-error: true
+        continue-on-error: true            # ← let pipeline continue even if vulns found
+
       - uses: contentstack/sca-policy@main