reusable-snyk-scan.yml

##
#

name: snyk-dependency-scan
on:
  workflow_call:
    inputs:
      container_image:
        type: string
        required: false
        description: Container image to scan (defaults to branch name)
      target_ref:
        type: string
        required: false
        description: Target Reference for Snyk (defaults to branch name)
      severity_threshold:
        type: string
        default: high
        description: Severity threshold to fail the build
      command:
        type: string
        default: test
        description: Command to run
    secrets:
      SNYK_TOKEN:
        required: false
        description: Optional snyk token

jobs:
  snyk:
    name: Snyk
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      snyk_available: ${{ secrets.SNYK_TOKEN  != '' && 'true' || 'false' }}
      container_image: ${{ inputs.container_image || format('ghcr.io/{0}:{1}', github.repository, github.ref_name) }}
    steps:
      - name: Checkout repository
        if: ${{ env.snyk_available == 'true' }}
        uses: actions/checkout@v4

      - name: Snyk ${{ inputs.command }}
        if: ${{ env.snyk_available == 'true' }}
        continue-on-error: true
        uses: snyk/actions/golang@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=${{ inputs.severity_threshold }} --project-name=${{ github.repository }} --target-reference=${{ inputs.target_ref || github.ref_name }}
          command: ${{ inputs.command }}

      - name: Snyk ${{ inputs.command }} docker image ${{ env.container_image }}
        if: ${{ env.snyk_available == 'true' }}
        continue-on-error: true
        uses: snyk/actions/docker@master
        with:
          image: ${{ env.container_image }}
          args: --file=Dockerfile --severity-threshold=${{ inputs.severity_threshold }} --project-name=${{ github.repository }} --target-reference=${{ inputs.target_ref || github.ref_name }}
          command: ${{ inputs.command }}
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}