diff --git a/.github/workflows/snyk-code-scan-python.yml b/.github/workflows/snyk-code-scan-python.yml index 021bb1f..fd38685 100644 --- a/.github/workflows/snyk-code-scan-python.yml +++ b/.github/workflows/snyk-code-scan-python.yml @@ -44,4 +44,4 @@ jobs: uses: github/codeql-action/upload-sarif@main with: sarif_file: snyk.sarif - category: "snyk" + category: "snyk-python" diff --git a/.github/workflows/snyk-container-scan.yml b/.github/workflows/snyk-container-scan.yml new file mode 100644 index 0000000..9fa2a76 --- /dev/null +++ b/.github/workflows/snyk-container-scan.yml @@ -0,0 +1,91 @@ +name: Snyk Container Scan + +# Controls when the workflow will run +on: + # This workflow uses the "workflow_call" event to allow it to be called from other workflows + workflow_call: + inputs: + working_directory: + required: false + type: string + default: "." + image_name: + required: true + type: string + default: "your/image-to-test" + +# Assign permissions for the workflow +permissions: + contents: read + +env: + wrk_dir: ${{ inputs.working_directory }} + img: ${{ inputs.image_name }} + +jobs: + security: + name: Snyk Container Scan + permissions: + actions: read + contents: read + security-events: write + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@master + - name: Check directory + run: | + if [ ! -d "$WRK_DIR" ] + then + echo "Directory $WRK_DIR does not exist." + exit 1 + fi + shell: bash + env: + WRK_DIR: ${{ env.wrk_dir }} + - name: Check Dockerfile + run: | + if [ ! -f "$WRK_DIR/Dockerfile" ] + then + echo "Dockerfile not found in $WRK_DIR." + exit 1 + fi + shell: bash + env: + WRK_DIR: ${{ env.wrk_dir }} + - name: Check Docker image name + run: | + if [[ ! "$IMG" =~ ^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*(\/[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)*$ ]] + then + echo "Image name is not correct." + exit 1 + fi + shell: bash + env: + IMG: ${{ env.img }} + - name: Build a Docker image + run: | + docker build -t $IMG $WRK_DIR + shell: bash + env: + IMG: ${{ env.img }} + WRK_DIR: ${{ env.wrk_dir }} + - name: Run Snyk to check Docker image for vulnerabilities + # Snyk can be used to break the build when it detects vulnerabilities. + # In this case we want to upload the issues to GitHub Code Scanning + continue-on-error: true + uses: snyk/actions/docker@master + env: + # In order to use the Snyk Action you will need to have a Snyk API token. + # See https://docs.snyk.io/integrations/ci-cd-integrations/github-actions-integration#getting-your-snyk-token + # or you can sign up for free at https://snyk.io/login + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + image: ${{ env.img }} + args: --file=${{ env.wrk_dir }}/Dockerfile + - name: Upload result to GitHub Code Scanning + if: ${{ hashFiles('**/snyk.sarif') != '' }} + uses: github/codeql-action/upload-sarif@main + with: + sarif_file: snyk.sarif + category: "snyk-container"