Snyk Scan #378

	# This workflow sets up Snyk scans

	name: Snyk Scan

	on:
	push:
	branches: ["main" ]
	pull_request:
	branches: ["main"]
	schedule: # Run snyk scan daily at midnight
	- cron: '0 0 * * *'

	permissions:
	contents: read

	jobs:
	snyk:
	permissions:
	contents: read # for actions/checkout to fetch code
	security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
	actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@master

	- name: Install Helm Dependencies
	id: helm_dependencies
	run: \|
	for dir in $(ls -d charts/*/); do
	helm dep up $dir
	done

	- name: Render Helm Templates
	id: helm_template_rendering
	run: \|
	for dir in $(ls -d charts/*/); do
	helm template $dir -f $dir/values.yaml --output-dir ./output
	done

	- name: Snyk IaC report vulnerabilities
	uses: snyk/actions/iac@master
	continue-on-error: true # To make sure that SARIF upload gets called
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
	with:
	file: ./output
	args: --sarif-file-output=snyk.sarif

	# Push the Snyk Code results into GitHub Code Scanning tab
	- name: Upload result to GitHub Code Scanning
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: snyk.sarif

	- name: Snyk IaC gatekeeper
	uses: snyk/actions/iac@master
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
	with:
	args:
	--sarif-file-output=snyk.sarif
	--policy-path=.snyk
	--severity-threshold=high # Forces fail on high-severity vulnerabilities

Provide feedback