Snyk checks on pull requests