{"id":15762024,"url":"https://github.com/garethr/snykus","last_synced_at":"2025-04-21T03:32:35.808Z","repository":{"id":66535179,"uuid":"294620253","full_name":"garethr/snykus","owner":"garethr","description":"A real-world workflow for using Docker, Snyk and GitHub to build, secure and publish container images.","archived":false,"fork":false,"pushed_at":"2020-09-28T09:38:22.000Z","size":335,"stargazers_count":5,"open_issues_count":1,"forks_count":7,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-13T02:13:38.875Z","etag":null,"topics":["docker","ghcr","snyk"],"latest_commit_sha":null,"homepage":"","language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/garethr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-09-11T07:05:38.000Z","updated_at":"2021-03-05T02:05:54.000Z","dependencies_parsed_at":"2023-03-17T06:00:35.656Z","dependency_job_id":null,"html_url":"https://github.com/garethr/snykus","commit_stats":{"total_commits":13,"total_committers":1,"mean_commits":13.0,"dds":0.0,"last_synced_commit":"bb07b012f25f72a1cefb541240f7b62e37c564ed"},"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garethr%2Fsnykus","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garethr%2Fsnykus/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garethr%2Fsnykus/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garethr%2Fsnykus/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/garethr","download_url":"https://codeload.github.com/garethr/snykus/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249991176,"owners_count":21357217,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","ghcr","snyk"],"created_at":"2024-10-04T11:06:03.168Z","updated_at":"2025-04-21T03:32:35.534Z","avatar_url":"https://github.com/garethr.png","language":"Dockerfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Snykus\n\nA real-world workflow for using Docker, Snyk and GitHub to build, secure and publish container images.\n\n\u003e 1. Build images on push, pull request and on a recurring schedule\n\u003e 2. Cache the layers between runs for faster builds\n\u003e 3. Push images to GitHub Container Registry depending on the nature of the ref\n\u003e 4. Monitor the different tags for vulnerabilities with Snyk\n\u003e 5. Fail a pull request check if the PR introduces a high-severity vulnerability\n\nThe workflow is reasonably complex, but it's also very powerful.\n\n## Monitoring in Snyk\n\nThe workflow will build several different images, namely:\n\n* Version tags, like `v0.1.0`\n* `edge`, built from the default branch\n* `nightly`, built once per day from the default branch\n\nEach of these are pushed to GitHub Container Registry:\n\n![GitHub Container Registry](assets/registry.png)\n\nThey are also monitored for vulnerabilities in Snyk:\n\n![Showing vulnerabilities in Snyk](assets/monitor.png)\n\nBy monitoring them in Snyk we can see the current vulnerabilities, but Snyk will also send alerts as new vulnerabilities are announced for images, even if they are not rebuilt for a period of time.\n\n\n## Blocking a pull request with high-severity vulnerabilities\n\nThe workflow will fail the pull request check if the changes introduce high-severity vulnerabilities into the image. You can see an example of this in action in [#1](https://github.com/garethr/snykus/pull/1).\n\n![Showing a failing PR check](assets/pr.png)\n\n\n## Showing vulnerabilities in `latest` in GitHub Code Scanning\n\nThe `latest` image vulnerabilities are also uploaded to GitHub Code Scanning, so we can see a list of issues directly in GitHub.\n\n![GitHub Code Scanning](assets/codescanning.png)\n\nWe are also adding additional context to the output using [the Secure Code Warrior](https://github.com/SecureCodeWarrior/github-action-add-sarif-contextual-training) action.\n\n\n_Inspired by the example workflow from [docker/build-push-action](https://github.com/docker/build-push-action#complete-workflow)._\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgarethr%2Fsnykus","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgarethr%2Fsnykus","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgarethr%2Fsnykus/lists"}