snyk.yaml

name: SNYK

on:
  schedule:
    - cron: "0 0 * * 0"

jobs:
  scan-iac:
    name: Scan Rendered Templates
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
        with:
          version: v3.17.0

      - name: Render Templates
        run: |
          helm repo add bitnami https://charts.bitnami.com/bitnami
          helm repo add backstage https://backstage.github.io/charts
          helm repo update    
          helm dependency build ./charts/backstage
          helm template ./charts/backstage/ --output-dir ./output

      - name: Run SNYK IaC Scan
        continue-on-error: true
        uses: snyk/actions/iac@b98d498629f1c368650224d6d212bf7dfa89e4bf # 0.4.0
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
          SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }}
        with:
          args: --report --org=$SNYK_ORG_ID --target-name="redhat-developer/rhdh-chart"
          file: ./output/