ci: Fix snyk scan (#4317)

Co-authored-by: Link <link20050703@gmail.com>

.github/workflows/docker-app-rest-passthrough.yml

@@ -109,19 +109,9 @@ jobs:
           path: /tmp
       - name: Load Docker image
         run: docker load --input /tmp/rest-passthrough-image.tar
+
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        if: ${{ github.event_name == 'schedule' || github.event_name == 'push' }}
-        with:
-          image-ref: 'discordeno/app-rest-passthrough:latest'
-          format: 'table'
-          exit-code: '0'
-          ignore-unfixed: true
-          vuln-type: 'os,library'
-          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        if: ${{ github.event_name == 'schedule' || github.event_name == 'push' }}
+        uses: aquasecurity/trivy-action@0.32.0
         with:
           image-ref: 'discordeno/app-rest-passthrough:latest'
           exit-code: '0'
@@ -131,30 +121,51 @@ jobs:
           output: 'trivy-results.sarif'
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
-        if: ${{ github.event_name == 'schedule' || github.event_name == 'push' }}
         with:
           sarif_file: 'trivy-results.sarif'
 
       - name: Run Snyk to check Docker image for vulnerabilities
-        if: ${{ github.event_name == 'schedule' || github.event_name == 'push' }}
         continue-on-error: true
-        uses: snyk/actions/docker@master
+        uses: snyk/actions/docker@0.4.0
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
           image: 'discordeno/app-rest-passthrough:latest'
           args: --file=docker-apps/rest-passthrough/Dockerfile
+
       # Snyk will use a security-severify of "null" when the CVE didn't get an assigned score
       - name: Replace security-severity null for non assigned CVE scores
-        if: ${{ github.event_name == 'schedule' || github.event_name == 'push' }}
         run: |
           sed -i 's/"security-severity": "null"/"security-severity": "0"/g' snyk.sarif
           sed -i 's/"cvssv3_baseScore": null/"cvssv3_baseScore": 0/g' snyk.sarif
+
+      # Snyk will test 3 projects and will use for ALL 3 the same tool driver name, which is not supported anymore by github/codeql-action/upload-sarif
+      # So since there seem to be no way to tell the Snyk CLI (what the snyk/actions/docker actions actually runs) to use distict names or generate multiple
+      # sarif file to then assign different categories to we need to modify the SARIF file itself before uploading it to make sure that each run described
+      # by the sarif file has a unique tool name
+      - name: Change the Snyk tool names to different names
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const filePath = 'snyk.sarif';
+            const data = fs.readFileSync(filePath, 'utf8');
+            const json = JSON.parse(data);
+
+            let index = 0;
+            for (const run of json.runs) {
+              if (run.tool.driver.name === "Snyk Container") {
+                run.tool.driver.name = `Snyk Container #${index++}`;
+              }
+            }
+
+            fs.writeFileSync(filePath, JSON.stringify(json, null, 2));
+
       - name: Upload snyk scan results to GitHub Security tab
-        if: ${{ github.event_name == 'schedule' || github.event_name == 'push' }}
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: snyk.sarif
+          category: snyk-report
 
   build-all-arch:
     name: Build image for all architectures