snyk-3rd-party-dockers.yml

name: Snyk 3rd party Docker image scan

on:
  workflow_dispatch:

jobs:
  get_images:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.read_images.outputs.images }}
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Extract Docker images
        run: |
          grep -E "^\s*image:" docker-compose.yml | awk '{print $2}'  | grep -v "^leistivo" | sort | uniq > imgs.txt

      - name: List all files
        run: ls -l ${{ github.workspace }}

      - name: test jq
        run: echo $(jq -R -s -c 'split("\n")[:-1]' imgs.txt)

      - name: Read images
        id: read_images
        run: |
          echo "images=$(jq -R -s -c 'split("\n")[:-1]' imgs.txt)" >> "$GITHUB_OUTPUT"
        shell: bash

  snyk_scan:
    runs-on: ubuntu-latest
    needs: get_images
    strategy:
      matrix:
        image: ${{ fromJson(needs.get_images.outputs.matrix) }}
    steps:
      - name: Scan Docker images with Snyk
        uses: snyk/actions/docker@master
        continue-on-error: true
        with:
          image: ${{ matrix.image }}
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}