Split trivy and snyk back up

- Changed snyk command
OpenMined · Jul 5, 2023 · 3a64039 · 3a64039
1 parent ec75fab
commit 3a64039
Showing 1 changed file with 89 additions and 37 deletions.
diff --git a/.github/workflows/container-scan.yml b/.github/workflows/container-scan.yml
@@ -15,24 +15,16 @@ on:
         required: false
 
 jobs:
-  scan-backend:
+  scan-backend-trivy:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
       actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - name: Set up Snyk CLI to check for security issues
-        # Snyk can be used to break the build when it detects security issues.
-        # In this case we want to upload the SAST issues to GitHub Code Scanning
-        uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
-
-        env:
-          # This is where you will need to introduce the Snyk API token created with your Snyk account
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
-        # Build the docker image for testing
+      # Build the docker image for testing
       - name: Build a Docker image
         run: DOCKER_BUILDKIT=1 docker build -f packages/grid/backend/backend.dockerfile packages -t backend:${{ github.sha }}
         # Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
@@ -51,16 +43,7 @@ jobs:
         with:
           sarif_file: "trivy-results.sarif"
 
-      - name: Snyk Container monitor
-        run: snyk container monitor backend:${{ github.sha }} --file=packages/grid/backend/backend.dockerfile
-
-        # Push the Snyk Code results into GitHub Code Scanning tab
-      - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: snyk-code.sarif
-
-  scan-frontend:
+  scan-backend-snyk:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
@@ -72,25 +55,38 @@ jobs:
         # Snyk can be used to break the build when it detects security issues.
         # In this case we want to upload the SAST issues to GitHub Code Scanning
         uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
-
         env:
           # This is where you will need to introduce the Snyk API token created with your Snyk account
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
-        # Build the docker image for testing
+      # Build the docker image for testing
       - name: Build a Docker image
-        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/frontend/frontend.dockerfile packages/grid/frontend -t frontened:${{ github.sha }}
+        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/backend/backend.dockerfile packages -t backend:${{ github.sha }}
         # Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
 
-      - name: Snyk Container monitor
-        run: snyk container monitor frontend:${{ github.sha }} --file=packages/grid/frontend/frontend.dockerfile
+      - name: Snyk Container test
+        run: snyk container test backend:${{ github.sha }} --file=packages/grid/backend/backend.dockerfile --sarif --sarif-file-output=snyk-code.sarif
 
         # Push the Snyk Code results into GitHub Code Scanning tab
       - name: Upload result to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: snyk-code.sarif
 
+  scan-frontend-trivy:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      # Build the docker image for testing
+      - name: Build a Docker image
+        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/frontend/frontend.dockerfile packages -t frontend:${{ github.sha }}
+        # Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
         with:
@@ -105,7 +101,7 @@ jobs:
         with:
           sarif_file: "trivy-results.sarif"
 
-  scan-tailscale:
+  scan-frontend-snyk:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
@@ -117,25 +113,38 @@ jobs:
         # Snyk can be used to break the build when it detects security issues.
         # In this case we want to upload the SAST issues to GitHub Code Scanning
         uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
-
         env:
           # This is where you will need to introduce the Snyk API token created with your Snyk account
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
-        # Build the docker image for testing
+      # Build the docker image for testing
       - name: Build a Docker image
-        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/vpn/tailscale.dockerfile packages/grid/vpn -t tailscale:${{ github.sha }}
+        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/frontend/frontend.dockerfile packages -t frontend:${{ github.sha }}
         # Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
 
-      - name: Snyk Container monitor
-        run: snyk container monitor tailscale:${{ github.sha }} --file=packages/grid/vpn/tailscale.dockerfile
+      - name: Snyk Container test
+        run: snyk container test frontend:${{ github.sha }} --file=packages/grid/frontend/frontend.dockerfile --sarif --sarif-file-output=snyk-code.sarif
 
         # Push the Snyk Code results into GitHub Code Scanning tab
       - name: Upload result to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: snyk-code.sarif
 
+  scan-tailscale-trivy:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      # Build the docker image for testing
+      - name: Build a Docker image
+        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/vpn/tailscale.dockerfile packages -t tailscale:${{ github.sha }}
+        # Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
         with:
@@ -150,7 +159,7 @@ jobs:
         with:
           sarif_file: "trivy-results.sarif"
 
-  scan-headscale:
+  scan-tailscale-snyk:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
@@ -162,25 +171,38 @@ jobs:
         # Snyk can be used to break the build when it detects security issues.
         # In this case we want to upload the SAST issues to GitHub Code Scanning
         uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
-
         env:
           # This is where you will need to introduce the Snyk API token created with your Snyk account
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
-        # Build the docker image for testing
+      # Build the docker image for testing
       - name: Build a Docker image
-        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/vpn/headscale.dockerfile packages/grid/vpn -t headscale:${{ github.sha }}
+        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/vpn/tailscale.dockerfile packages -t tailscale:${{ github.sha }}
         # Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
 
-      - name: Snyk Container monitor
-        run: snyk container monitor headscale:${{ github.sha }} --file=packages/grid/vpn/headscale.dockerfile
+      - name: Snyk Container test
+        run: snyk container test tailscale:${{ github.sha }} --file=packages/grid/vpn/tailscale.dockerfile --sarif --sarif-file-output=snyk-code.sarif
 
         # Push the Snyk Code results into GitHub Code Scanning tab
       - name: Upload result to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: snyk-code.sarif
 
+  scan-headscale-trivy:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      # Build the docker image for testing
+      - name: Build a Docker image
+        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/vpn/headscale.dockerfile packages -t headscale:${{ github.sha }}
+        # Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
         with:
@@ -194,3 +216,33 @@ jobs:
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: "trivy-results.sarif"
+
+  scan-headscale-snyk:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Snyk CLI to check for security issues
+        # Snyk can be used to break the build when it detects security issues.
+        # In this case we want to upload the SAST issues to GitHub Code Scanning
+        uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
+        env:
+          # This is where you will need to introduce the Snyk API token created with your Snyk account
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+      # Build the docker image for testing
+      - name: Build a Docker image
+        run: DOCKER_BUILDKIT=1 docker build -f packages/grid/vpn/headscale.dockerfile packages -t headscale:${{ github.sha }}
+        # Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
+
+      - name: Snyk Container test
+        run: snyk container test headscale:${{ github.sha }} --file=packages/grid/vpn/headscale.dockerfile --sarif --sarif-file-output=snyk-code.sarif
+
+        # Push the Snyk Code results into GitHub Code Scanning tab
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: snyk-code.sarif