Add Snyk Security workflow to monitor multiple tags

.github/workflows/release.yaml

@@ -27,15 +27,21 @@ on:
               type: string
               default: "project-codeflare"
 
+env:
+  PR_BRANCH_NAME: snyk-tag-monitoring-${{ github.run_id }}
+
 jobs:
     release:
         runs-on: ubuntu-latest
         permissions:
             contents: write
             id-token: write  # This permission is required for trusted publishing
+            pull-requests: write # This permission is required for creating PRs
         steps:
             - name: Checkout the repository
               uses: actions/checkout@v4
+              with:
+                  token: ${{ secrets.GH_CLI_TOKEN }}
             - name: Install Python
               uses: actions/setup-python@v5
               with:
@@ -81,3 +87,21 @@ jobs:
               env:
                 GITHUB_TOKEN: ${{ secrets.CODEFLARE_MACHINE_ACCOUNT_TOKEN }}
               shell: bash
+
+            - name: Install Snyk CLI and setup monitoring for new release tag
+              env:
+                SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+                SNYK_ORG: ${{ secrets.SNYK_ORG }}
+              run: |
+                echo "Installing Snyk CLI"
+                npm install -g snyk
+
+                echo "Fetching tags"
+                git fetch origin 'refs/tags/*:refs/tags/*'
+
+                echo "Authenticating with Snyk"
+                snyk auth ${SNYK_TOKEN}
+
+                echo "Scanning project: codeflare-sdk/v${{ github.event.inputs.release-version }}"
+                git checkout v${{ github.event.inputs.release-version }}
+                snyk monitor --all-projects --exclude=requirements.txt --org=${SNYK_ORG} --target-reference="$(git describe --tags)"

.github/workflows/snyk-security.yaml

@@ -0,0 +1,29 @@
+name: Snyk Security
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  snyk-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Snyk CLI
+        run: npm install -g snyk
+
+      - name: Snyk Monitor and Test multiple projects
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+          SNYK_ORG: ${{ secrets.SNYK_ORG }}
+        run: |
+          echo "Fetching tags"
+          git fetch origin 'refs/tags/*:refs/tags/*'
+
+          echo "Authenticating with Snyk"
+          snyk auth ${SNYK_TOKEN}
+
+          echo "Scanning project: codeflare-sdk/main"
+          snyk monitor --all-projects --exclude=requirements.txt --org=${SNYK_ORG} --target-reference="main"