scheduled-snyk-docker.yaml

name: Snyk scheduled Docker base image scan

on:
  schedule:
    - cron: '0 3 * * 1'
  workflow_dispatch:

env:
  DOCKER_IMAGE: radarbase/radar-schemas-tools

jobs:
  security:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3

      - name: Run Snyk to check for vulnerabilities
        continue-on-error: true # To make sure that SARIF upload gets called
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ env.DOCKER_IMAGE }}
          # 'exclude-app-vulns' only tests vulnerabilities in the base image.
          # Code base vulnerabilities are tested the scheduled-snyk.yaml action.
          args: >-
            --file=Dockerfile
            --fail-on=upgradable
            --severity-threshold=high
            --policy-path=.snyk
            --exclude-app-vulns
            --org=radar-base
            --sarif-file-output=snyk.sarif

      # Detected vulnerabilities will appear on Github in Security->Code_scanning_alerts tab
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif