|
56 | 56 |
|
57 | 57 | - name: Perform CodeQL Analysis |
58 | 58 | uses: github/codeql-action/analyze@v2 |
59 | | - |
60 | | - snyk-code: |
61 | | - name: Snyk Code |
62 | | - runs-on: ubuntu-latest |
63 | | - steps: |
64 | | - - name: Checkout repository |
65 | | - uses: actions/checkout@v3 |
66 | | - - name: Run Snyk to check for vulnerabilities |
67 | | - uses: snyk/actions/golang@master |
68 | | - continue-on-error: true # To make sure that SARIF upload gets called |
69 | | - env: |
70 | | - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} |
71 | | - with: |
72 | | - args: --sarif-file-output=snyk.sarif |
73 | | - - name: Upload result to GitHub Code Scanning |
74 | | - uses: github/codeql-action/upload-sarif@v2 |
75 | | - with: |
76 | | - sarif_file: snyk.sarif |
77 | | - |
78 | | - snyk-container: |
79 | | - name: Snyk Container |
80 | | - runs-on: ubuntu-latest |
81 | | - steps: |
82 | | - - name: Checkout repository |
83 | | - uses: actions/checkout@v3 |
84 | | - - name: Build a Docker image |
85 | | - run: docker build -t image . |
86 | | - - name: Run Snyk to check Docker image for vulnerabilities |
87 | | - # Snyk can be used to break the build when it detects vulnerabilities. |
88 | | - # In this case we want to upload the issues to GitHub Code Scanning |
89 | | - continue-on-error: true |
90 | | - uses: snyk/actions/docker@master |
91 | | - env: |
92 | | - # In order to use the Snyk Action you will need to have a Snyk API token. |
93 | | - # More details in https://github.com/snyk/actions#getting-your-snyk-token |
94 | | - # or you can signup for free at https://snyk.io/login |
95 | | - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} |
96 | | - with: |
97 | | - image: image |
98 | | - args: --file=Dockerfile |
99 | | - - name: Upload result to GitHub Code Scanning |
100 | | - uses: github/codeql-action/upload-sarif@v2 |
101 | | - with: |
102 | | - sarif_file: snyk.sarif |
0 commit comments