snyk-security.yml

name: Snyk Security

on:
  push:
    branches: ["main" ]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

jobs:
  snyk:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - dockerfile: ./Dockerfile
            image: kennyopennix/wazuh-agent
          - dockerfile: ./images/Dockerfie.amazonlinux
            image: kennyopennix/wazuh-agent-amazonlinux
          - dockerfile: ./images/Dockerfie.ubuntu
            image: kennyopennix/wazuh-agent-ubuntu
    steps:
      - uses: actions/checkout@v3
      - name: Set up Snyk CLI to check for security issues
        uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Snyk Code test
        continue-on-error: true
        run: snyk code test -d --sarif --severity-threshold=high > snyk-code.sarif # || true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Build a Docker image
        continue-on-error: true
        run: docker build -t ${{ matrix.image }}  -f ${{ matrix.dockerfile }} .

      - name: Snyk Container monitor
        continue-on-error: true
        run: snyk container monitor ${{ matrix.image }} --file=${{ matrix.dockerfile }}
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: snyk-code.sarif