snyk-container.yml

name: Snyk Container

on:
  push:
    branches: [ "main" ]
  schedule:
    - cron: '28 18 * * 2'

permissions:
  contents: read

jobs:
  build-7-4:
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Build 7.4 images
      run: |
        cd ./7.4
        make latest

  scan-7-4:
    needs: build-7-4
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 7.4 for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:7.4
        args: --file=./7.4/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  scan-7-4-xdebug:
    needs: build-7-4
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 7.4-xdebug for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:7.4-xdebug
        args: --file=./7.4/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  build-8-0:
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Build 8.0 images
      run: |
        cd ./8.0
        make latest

  scan-8-0:
    needs: build-8-0
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 8.0 for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:8.0
        args: --file=./8.0/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  scan-8-0-xdebug:
    needs: build-8-0
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 8.0-xdebug for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:8.0-xdebug
        args: --file=./8.0/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  build-8-1:
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Build 8.1 images
      run: |
        cd ./8.1
        make latest

  scan-8-1:
    needs: build-8-1
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 8.1 for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:8.1
        args: --file=./8.1/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  scan-8-1-xdebug:
    needs: build-8-1
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 8.1-xdebug for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:8.1-xdebug
        args: --file=./8.1/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  build-8-2:
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Build 8.2 images
      run: |
        cd ./8.2
        make latest

  scan-8-2:
    needs: build-8-2
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 8.2 for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:8.2
        args: --file=./8.2/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  scan-8-2-xdebug:
    needs: build-8-2
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 8.2-xdebug for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:8.2-xdebug
        args: --file=./8.2/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  build-8-3:
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Build 8.3 images
      run: |
        cd ./8.3
        make latest

  scan-8-3:
    needs: build-8-3
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 8.3 for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:8.3
        args: --file=./8.3/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'

  scan-8-3-xdebug:
    needs: build-8-3
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Snyk to check 8.3-xdebug for vulnerabilities
      continue-on-error: false
      uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: devdrops/php-toolbox:8.3-xdebug
        args: --file=./8.3/Dockerfile
    - name: Upload result to GitHub Code Scanning
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'snyk.sarif'