ci: Scanning with Snyk (#13)

.github/workflows/ci.yml

@@ -36,4 +36,11 @@ jobs:
         uses: phonito/phonito-scanner-action@master
         with:
           image: ${{ env.IMAGE_NAME }}:${{ steps.vars.outputs.docker_tag }}
-          phonito-token: '${{ secrets.PHONITO_TOKEN }}'      
+          phonito-token: '${{ secrets.PHONITO_TOKEN }}'
+
+      - name: Scan with Snyk
+        uses: snyk/actions/[email protected]
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          image: ${{ env.IMAGE_NAME }}:${{ steps.vars.outputs.docker_tag }}

.github/workflows/ci_cd.yml

@@ -49,6 +49,13 @@ jobs:
           image: ${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}
           phonito-token: '${{ secrets.PHONITO_TOKEN }}'
 
+      - name: Scan with Snyk
+        uses: snyk/actions/[email protected]
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          image: ${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}
+
       - name: "Tag image as latest"
         if: env.RELEASE_VERSION != ''
         run: "docker tag $IMAGE_NAME:$RELEASE_VERSION $IMAGE_NAME:latest"

.github/workflows/regular_scan.yml

@@ -17,4 +17,11 @@ jobs:
         uses: phonito/phonito-scanner-action@master
         with:
           image: ${{ env.IMAGE_NAME }}:latest
-          phonito-token: '${{ secrets.PHONITO_TOKEN }}'
+          phonito-token: '${{ secrets.PHONITO_TOKEN }}'
+
+      - name: Scan with Snyk
+        uses: snyk/actions/[email protected]
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          image: ${{ env.IMAGE_NAME }}:latest

SECURITY.md

@@ -10,6 +10,6 @@ Known security issues will be published in GitHub repository's Security / Securi
 
 ## Automated processes
 
-The Docker image is scanned for vulnerabilities every 24 hours using [Phonito.io](https://phonito.io/?b=a). You can see the scan status under the actions tab / Regular Docker image vulnerability scan.
+The Docker image is scanned for vulnerabilities every 24 hours using [Phonito.io](https://phonito.io/?b=a) and [Snyk](https://snyk.io). You can see the scan status under the actions tab / Regular Docker image vulnerability scan.
 
 The dependencies are automatically scanned using [Dependabot](https://dependabot.com/). Dependencies are regularly updated. You can check for pending dependency updates by listing open Pull requests with the "dependencies" label.