diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index d44b3ba7b2..e39ed9b5cd 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -59,48 +59,3 @@ jobs: run: 'echo "IMAGE_VERSION=$(jq .version dist/linux_amd64/metadata.json --raw-output)" >> $GITHUB_ENV' - name: "run trivy on release image" run: "docker run -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image --format table --exit-code 1 --ignore-unfixed --vuln-type os,library --no-progress --severity CRITICAL,HIGH,MEDIUM authzed/spicedb:v${{ env.IMAGE_VERSION }}-amd64" - - snyk-code: - name: "Analyze Go code with Snyk" - permissions: - contents: "read" # for actions/checkout to fetch code - security-events: "write" # for github/codeql-action/upload-sarif to upload SARIF results - actions: "read" # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status - runs-on: "buildjet-2vcpu-ubuntu-2204" - steps: - - uses: "actions/checkout@master" - - name: "Run Snyk to check for vulnerabilities" - uses: "snyk/actions/golang@master" - continue-on-error: true # To make sure that SARIF upload gets called - env: - SNYK_TOKEN: "${{ secrets.SNYK_TOKEN }}" - with: - args: "--sarif-file-output=snyk.sarif" - - name: "Upload result to GitHub Code Scanning" - uses: "github/codeql-action/upload-sarif@v3" - with: - sarif_file: "snyk.sarif" - - snyk-docker: - name: "Analyze Docker with Snyk" - permissions: - contents: "read" # for actions/checkout to fetch code - security-events: "write" # for github/codeql-action/upload-sarif to upload SARIF results - actions: "read" # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status - runs-on: "buildjet-2vcpu-ubuntu-2204" - steps: - - uses: "actions/checkout@master" - - name: "Build a Docker image" - run: "DOCKER_BUILDKIT=1 docker build -t authzed/spicedb ." - - name: "Run Snyk to check Docker image for vulnerabilities" - continue-on-error: true - uses: "snyk/actions/docker@master" - env: - SNYK_TOKEN: "${{ secrets.SNYK_TOKEN }}" - with: - image: "authzed/spicedb" - args: "--file=Dockerfile" - - name: "Upload result to GitHub Code Scanning" - uses: "github/codeql-action/upload-sarif@v3" - with: - sarif_file: "snyk.sarif"