snyk_scan_aws_prod.yml

name: Weekly Snyk scan of aws-prod

on:
  workflow_dispatch:
  schedule: # At 09:00 every Saturday
    - cron: '0 9 * * SAT'

env:
  KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}
  SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  AWS_ACCOUNT_ID: 274425519734
  AWS_REGION: eu-central-1

jobs:
  snyk-scan:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version:
            "2.6.10"

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1-node16
        with:
            role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/gh_actions_snyk_scans
            aws-region: ${{ env.AWS_REGION }}
            role-duration-seconds: 2400
            role-session-name: ${{ github.event.repository.name }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk
        run:
          ./snyk_scan_live_artifacts_and_report_to_kosli.sh aws-prod