docker-scans.yml

name: 🐳🔎 Docker scans

on:
  push:
    branches:
      - main
    paths-ignore:      
      - "README.md"
      - "tests/**"
  workflow_dispatch:

jobs:
  checkov:
    permissions:
      contents: read
      security-events: write
    uses: 0GiS0/scan-docker-vulnerabilities/.github/workflows/checkov.yaml@main
    with:
      dockerfile_path: build/docker/Dockerfile

  trivy:
    permissions:
      contents: read
      security-events: write
    uses: 0GiS0/scan-docker-vulnerabilities/.github/workflows/trivy.yaml@main
    with:
      dockerfile_path: build/docker/Dockerfile
      context: ./src  

  grype:
    permissions:
      contents: read
      security-events: write
    uses: 0GiS0/scan-docker-vulnerabilities/.github/workflows/grype.yaml@main
    with:
      dockerfile_path: build/docker/Dockerfile
      context: ./src

  snyk:
    permissions:
      contents: read
      security-events: write
    uses: 0GiS0/scan-docker-vulnerabilities/.github/workflows/snyk.yaml@main
    with:
      dockerfile_path: build/docker/Dockerfile
      context: ./src

    secrets:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}