snyk.yaml

name: Snyk Scan

on:
  workflow_call:
    secrets:
      SNYK_TOKEN:
        required: true
    inputs:
      image_name:
        description: 'The name of the docker image to build'
        type: string
        required: false
        default: 'apache'
        
      dockerfile_path:
        description: 'The path of the Dockerfile'
        type: string
        required: false
        default: './Dockerfile'

      context:
        description: 'The path of the directory that we are going to use as a context to build the image'
        type: string
        required: false
        default: '.'     

jobs:
  snyk:
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
                  
      - name: Build the Container image
        run: docker build ${{ inputs.context }} --file ${{ inputs.dockerfile_path }} --tag ${{ inputs.image_name }}

      - name: Run Snyk to check Docker image for vulnerabilities
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ inputs.image_name }}
          args: --file=${{ inputs.dockerfile_path }}

      # Push the Snyk Code results into GitHub Code Scanning tab
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        if: success() || failure()
        with:
          sarif_file: snyk.sarif