diff --git a/.github/workflows/snyk.yaml b/.github/workflows/snyk.yaml index 57f135f2..f20f76a0 100644 --- a/.github/workflows/snyk.yaml +++ b/.github/workflows/snyk.yaml @@ -1,13 +1,21 @@ name: SNYK on: + workflow_dispatch: # allow manual runs from UI schedule: - - cron: "0 0 * * 0" + - cron: "0 0 * * 0" # weekly scan (every Sunday at 00:00 UTC) jobs: scan-iac: name: Scan Rendered Templates runs-on: ubuntu-latest + + strategy: + matrix: + chart: + - backstage + - orchestrator-infra + steps: - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 @@ -19,32 +27,20 @@ jobs: with: version: v3.17.0 - - name: Render Templates + - name: Render Templates for ${{ matrix.chart }} run: | helm repo add bitnami https://charts.bitnami.com/bitnami helm repo add backstage https://backstage.github.io/charts - helm repo update - helm dependency build ./charts/backstage - helm dependency build ./charts/orchestrator-infra - helm template ./charts/backstage --output-dir ./output/backstage - helm template ./charts/orchestrator-infra --output-dir ./output/orchestrator-infra - - - name: Run SNYK IaC Scan for Developer Hub - continue-on-error: true - uses: snyk/actions/iac@b98d498629f1c368650224d6d212bf7dfa89e4bf # 0.4.0 - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }} - with: - args: --report --org=$SNYK_ORG_ID --target-name="redhat-developer/rhdh-chart/backstage" - file: ./output/backstage + helm repo update + helm dependency build ./charts/${{ matrix.chart }} + helm template ./charts/${{ matrix.chart }} --output-dir ./output/${{ matrix.chart }} - - name: Run Snyk IaC Scan for Orchestrator Infra + - name: Run Snyk IaC Scan for ${{ matrix.chart }} continue-on-error: true uses: snyk/actions/iac@b98d498629f1c368650224d6d212bf7dfa89e4bf # 0.4.0 env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }} with: - args: --report --org=$SNYK_ORG_ID --target-name="redhat-developer/rhdh-chart/orchestrator-infra" - file: ./output/orchestrator-infra + args: --report --org=$SNYK_ORG_ID --target-name="redhat-developer/rhdh-chart/${{ matrix.chart }}" + file: ./output/${{ matrix.chart }}