snyk-container.yml

name: snyk container scan

on:
  push:
    branches: [ develop ]
  pull_request:
    branches: [ develop ]

permissions:
  contents: read

jobs:
  snyk-container:
    permissions:
      contents: read
      security-events: write
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: build backman docker image
      run: docker build -t jamesclonk/backman:develop .
    - name: run snyk to check docker image for vulnerabilities
      continue-on-error: true
      uses: snyk/actions/docker@dc22abdbe8ec00e2a925256fef96f319ca5510ce
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        image: jamesclonk/backman:develop
        sarif: true
        args: --policy-path=. --file=Dockerfile
    - name: upload results to github code scanning
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: snyk.sarif