Add backend Docker build/push workflow and improve Snyk IaC workflow#11
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e25726d3e9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # or `main.tf` for a Terraform configuration file | ||
| file: your-file-to-test.yaml | ||
| run: | | ||
| snyk auth "$SNYK_TOKEN" |
There was a problem hiding this comment.
Because this workflow still runs on pull_request, forked PRs do not receive SNYK_TOKEN, so this newly unguarded snyk auth "$SNYK_TOKEN" exits before the || true scan/upload path can run. That regresses the previous continue-on-error behavior and makes external PR checks fail rather than just omitting Snyk results; guard this step or skip it when the secret is unavailable.
Useful? React with 👍 / 👎.
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| branches: [ main ] | ||
| pull_request: | ||
| # The branches below must be a subset of the branches above | ||
| branches: [ "main" ] | ||
| schedule: | ||
| - cron: '25 17 * * 1' | ||
| branches: [ main ] |
There was a problem hiding this comment.
This on: block now only runs Snyk on pushes and PRs, whereas the previous workflow also had a weekly Monday schedule. That means IaC findings that appear because Snyk's rules change, or because existing configuration becomes newly vulnerable, will not be refreshed in code scanning until someone happens to change the repository; keep the scheduled trigger if continuous infrastructure scanning is still expected.
Useful? React with 👍 / 👎.
| images: ${{ env.IMAGE_NAME }} | ||
| tags: | | ||
| type=sha | ||
| type=raw,value=latest |
There was a problem hiding this comment.
latest publishes to main
Because this workflow also allows workflow_dispatch, a manual run selected on any non-main ref will still publish the raw latest tag here. That can overwrite the production-looking GHCR tag with unmerged backend code; either gate this tag/push to refs/heads/main or avoid publishing latest for manual non-main runs.
Useful? React with 👍 / 👎.
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: snyk/snyk:alpine |
There was a problem hiding this comment.
Running the whole job in the snyk/snyk:alpine container also moves the JavaScript actions in this job (actions/checkout@v4 and github/codeql-action/upload-sarif@v4) into an Alpine/musl environment. Those actions are executed with the runner's bundled Node binary, which expects glibc, so the workflow can fail before Snyk ever scans; use a glibc-based Snyk image or run only the CLI invocation in the Snyk container.
Useful? React with 👍 / 👎.
1 participant
Motivation
parental-control-system/backend.Description
/.github/workflows/backend-docker.ymlthat checks out the repo, sets up Docker Buildx, logs into GHCR, extracts metadata withdocker/metadata-action@v5, and builds/pushes the image fromparental-control-system/backend/Dockerfileusingdocker/build-push-action@v6with SHA andlatesttags./.github/workflows/snyk-infrastructure.ymlto remove legacy comments, normalize branch syntax, addsecurity-events: writeandactions: readpermissions, and run the job inside thesnyk/snyk:alpinecontainer.snyk auth "$SNYK_TOKEN"and executessnyk iac test --sarif-file-output=snyk.sarif || trueto produce a SARIF file.github/codeql-action/upload-sarif@v4and made the upload conditional withif: always() && hashFiles('snyk.sarif') != ''to avoid errors when no SARIF is generated.Testing
mainor on manual dispatch.Codex Task