From 169e11771d3dbb5f2fbba25a66d4b1418a9ea862 Mon Sep 17 00:00:00 2001
From: Jonathan Ho <heiheiho000@gmail.com>
Date: Thu, 11 May 2023 08:12:20 -0700
Subject: [PATCH] ci: add snyk for image scan (#3031)

---
 .github/workflows/rest-proxy.yml | 56 ++++++++++++++++++++------------
 1 file changed, 36 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/rest-proxy.yml b/.github/workflows/rest-proxy.yml
index b7fdea47e..1fc212be3 100644
--- a/.github/workflows/rest-proxy.yml
+++ b/.github/workflows/rest-proxy.yml
@@ -3,16 +3,16 @@ name: Rest proxy
 on:
   push:
     branches:
-      - "main"
+      - 'main'
     paths:
-      - ".github/workflows/rest-proxy.yml"
-      - "proxies/rest/**"
+      - '.github/workflows/rest-proxy.yml'
+      - 'proxies/rest/**'
   pull_request:
     paths:
-      - ".github/workflows/rest-proxy.yml"
-      - "proxies/rest/**"
+      - '.github/workflows/rest-proxy.yml'
+      - 'proxies/rest/**'
   schedule:
-    - cron: "0 0 * * *"
+    - cron: '0 0 * * *'
 
 jobs:
   build:
@@ -59,6 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
+      - uses: actions/checkout@v3
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: Download artifact
@@ -71,27 +72,42 @@ jobs:
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master
         with:
-          image-ref: "discordeno/rest-proxy:latest"
-          format: "table"
-          exit-code: "0"
+          image-ref: 'discordeno/rest-proxy:latest'
+          format: 'table'
+          exit-code: '0'
           ignore-unfixed: true
-          vuln-type: "os,library"
-          severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
+          vuln-type: 'os,library'
+          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master
         if: ${{ github.event_name == 'schedule' }}
         with:
-          image-ref: "discordeno/rest-proxy:latest"
-          exit-code: "0"
-          vuln-type: "os,library"
-          severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
-          format: "sarif"
-          output: "trivy-results.sarif"
+          image-ref: 'discordeno/rest-proxy:latest'
+          exit-code: '0'
+          vuln-type: 'os,library'
+          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v2
         if: ${{ github.event_name == 'schedule' }}
         with:
-          sarif_file: "trivy-results.sarif"
+          sarif_file: 'trivy-results.sarif'
+
+      - name: Run Snyk to check Docker image for vulnerabilities
+        if: ${{ github.event_name == 'schedule' }}
+        continue-on-error: true
+        uses: snyk/actions/docker@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          image: 'discordeno/rest-proxy:latest'
+          args: --file=proxies/rest/Dockerfile
+      - name: Upload result to GitHub Code Scanning
+        if: ${{ github.event_name == 'schedule' }}
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: snyk.sarif
 
   build-all-arch:
     name: Build image for all architectures
@@ -117,7 +133,7 @@ jobs:
         with:
           context: proxies/rest
           push: false
-          tags: "discordeno/rest-proxy:latest"
+          tags: 'discordeno/rest-proxy:latest'
           # linux/s390x stuck at yarn install, remove it for now
           platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le
           target: runner
@@ -157,7 +173,7 @@ jobs:
         with:
           context: proxies/rest
           push: true
-          tags: "ghcr.io/discordeno/rest-proxy:latest"
+          tags: 'ghcr.io/discordeno/rest-proxy:latest'
           # linux/s390x stuck at yarn install, remove it for now
           platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le
           target: runner