Snyk ~ Container Security Scan #110

	---
	name: Snyk ~ Container Security Scan

	on:
	workflow_run:
	workflows: ["Publish Docker Image"]
	types:
	- completed
	schedule:
	- cron: "39 4 * * 0"

	permissions:
	contents: read

	jobs:
	snyk:
	if: github.ref == 'refs/heads/master'
	permissions:
	contents: read # for actions/checkout to fetch code
	security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
	actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	#- name: Build a Docker image
	# run: docker build -t black-mirror .
	- name: Run Snyk to check Docker image for vulnerabilities
	# Snyk can be used to break the build when it detects vulnerabilities.
	# In this case we want to upload the issues to GitHub Code Scanning
	continue-on-error: true
	uses: snyk/actions/docker@master
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
	with:
	image: ghcr.io/t145/black-mirror:latest
	args: --file=docker/Dockerfile.chainguard
	- name: "Filter SARIF for GitHub"
	shell: bash
	# Snyk produces multiple runs when --file is used.
	# GitHub now requires unique categories for each run in a single upload.
	# We'll keep only the first run (the image scan) to satisfy GitHub's policy.
	run: \|
	if [ -f snyk.sarif ]; then
	jq '.runs = [.runs[0]]' snyk.sarif > snyk.sarif.tmp && mv snyk.sarif.tmp snyk.sarif
	fi
	- name: Upload result to GitHub Code Scanning
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: snyk.sarif
	category: snyk-container

Provide feedback