snyk_iac_scan.yml

name: Snyk IaC scan
on:
  push:
    branches:
      - main

jobs:
  security:
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 1
      fail-fast: true
      matrix:
        org: [personal, work]
        include:
          - org: personal
            snyk_token: SNYK_TOKEN_WINTLTR
          - org: work
            snyk_token: SNYK_TOKEN
    steps:
      - uses: actions/checkout@master
      - name: Run Snyk to check for vulnerabilities
        id: snyk_scan
        uses: snyk/actions/iac@master
        continue-on-error: true # To make sure that SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets[matrix.snyk_token] }}
        with:
          args: --sarif-file-output=snyk.sarif --target-name=keebackup_iac --report
          command: test
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: snyk.sarif

      - name: Run random commands
        run: |
          echo ${{ matrix.org }} 
          echo ${{ matrix.snyk_token }}