snyk.yml

name: Snyk scan container images

on:
  workflow_call:
    inputs:
      ref:
        description: Git ref to checkout
        type: string
        required: false
        default: main
    secrets:
      snyk-token:
        description: Snyk authorization token
        required: true

jobs:
  inspect:
    runs-on: ubuntu-latest
    outputs:
      images: ${{ steps.read-images.outputs.images }}
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          ref: ${{ inputs.ref }}

      - name: Install Python
        uses: actions/setup-python@v2

      - name: Install required Python packages
        run: pip install -r build/requirements.txt

      - name: Install Helm
        uses: azure/setup-helm@v1

      - name: Extract images
        shell: bash
        run: make images
        continue-on-error: true

      - name: Read images
        id: read-images
        if: hashFiles('build/images/index.txt') != ''
        shell: bash
        run: echo "::set-output name=images::$(jq -R < build/images/index.txt | jq -sc)"

  scan-images:
    runs-on: ubuntu-latest
    needs: inspect
    if: fromJSON(needs.inspect.outputs.images)[0] != null
    strategy:
      matrix:
        image: ${{ fromJSON(needs.inspect.outputs.images) }}
      fail-fast: false
    steps:
      - name: Run Snyk to check Docker image for vulnerabilities (${{ matrix.image }})
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.snyk-token }}
        with:
          image: ${{ matrix.image }}