container-image-scan.yml

name: Container image scan (reusable)

on:
  workflow_call:
    inputs:
      image_version:
        description: The Docker container image version
        type: string
        required: true
        default: latest

jobs:
  container-image-scan:
    name: Snyk container image scan
    runs-on: ubuntu-latest

    strategy:
      matrix:
        versions:
          - CONTEXT: .
            image: ghcr.io/wiremock/wiremock:${{ inputs.image_version }}
          - CONTEXT: alpine
            image: ghcr.io/wiremock/wiremock:${{ inputs.image_version }}-alpine

    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: wiremock
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull image to check we've got it
        run: docker pull ${{ matrix.versions.image }}

      - name: Run Snyk to check Docker image for vulnerabilities
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ matrix.versions.image }}
          command: test
          args: --file=${{ matrix.versions.CONTEXT }}/Dockerfile --severity-threshold=high --fail-on=upgradable --org=f310ee2f-5552-444d-84ee-ec8c44c33adb --policy-path=${{ matrix.versions.CONTEXT }}/.snyk