Feature/snyk container scan

.github/workflows/snyk-code-scan-python.yml

@@ -44,4 +44,4 @@ jobs:
         uses: github/codeql-action/upload-sarif@main
         with:
           sarif_file: snyk.sarif
-          category: "snyk"
+          category: "snyk-python"

.github/workflows/snyk-container-scan.yml

@@ -0,0 +1,91 @@
+name: Snyk Container Scan
+
+# Controls when the workflow will run
+on:
+  # This workflow uses the "workflow_call" event to allow it to be called from other workflows
+  workflow_call:
+    inputs:
+      working_directory:
+        required: false
+        type: string
+        default: "."
+      image_name:
+        required: true
+        type: string
+        default: "your/image-to-test"
+
+# Assign permissions for the workflow      
+permissions:
+  contents: read
+
+env:
+  wrk_dir: ${{ inputs.working_directory }}
+  img: ${{ inputs.image_name }}
+
+jobs:
+  security:
+    name: Snyk Container Scan
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@master
+      - name: Check directory
+        run: |
+          if [ ! -d "$WRK_DIR" ]
+          then
+            echo "Directory $WRK_DIR does not exist."
+            exit 1
+          fi
+        shell: bash
+        env:
+          WRK_DIR: ${{ env.wrk_dir }}
+      - name: Check Dockerfile
+        run: |
+          if [ ! -f "$WRK_DIR/Dockerfile" ]
+          then
+            echo "Dockerfile not found in $WRK_DIR."
+            exit 1
+          fi
+        shell: bash
+        env:
+          WRK_DIR: ${{ env.wrk_dir }}
+      - name: Check Docker image name
+        run: |
+          if [[ ! "$IMG" =~ ^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*(\/[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*)*$ ]]
+          then
+            echo "Image name is not correct."
+            exit 1
+          fi
+        shell: bash
+        env:
+          IMG: ${{ env.img }}
+      - name: Build a Docker image
+        run: |
+          docker build -t $IMG $WRK_DIR
+        shell: bash
+        env:
+          IMG: ${{ env.img }}
+          WRK_DIR: ${{ env.wrk_dir }}
+      - name: Run Snyk to check Docker image for vulnerabilities
+        # Snyk can be used to break the build when it detects vulnerabilities.
+        # In this case we want to upload the issues to GitHub Code Scanning
+        continue-on-error: true
+        uses: snyk/actions/docker@master
+        env:
+          # In order to use the Snyk Action you will need to have a Snyk API token.
+          # See https://docs.snyk.io/integrations/ci-cd-integrations/github-actions-integration#getting-your-snyk-token
+          # or you can sign up for free at https://snyk.io/login
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          image: ${{ env.img }}
+          args: --file=${{ env.wrk_dir }}/Dockerfile
+      - name: Upload result to GitHub Code Scanning
+        if: ${{ hashFiles('**/snyk.sarif') != '' }}
+        uses: github/codeql-action/upload-sarif@main
+        with:
+          sarif_file: snyk.sarif
+          category: "snyk-container"