snyk_scan_aws_beta.yml

name: Regular Snyk scan of aws-beta

on:
  push:
    branches:
      - main
  workflow_dispatch:
  schedule: # At 09:00 every Saturday
    - cron: '0 9 * * SAT'

env:
  KOSLI_HOST_STAGING: ${{ vars.KOSLI_HOST_STAGING }}
  KOSLI_HOST_PROD: ${{ vars.KOSLI_HOST }}
  KOSLI_ORG: ${{ vars.KOSLI_ORG }}  # cyber-dojo
  KOSLI_API_TOKEN_STAGING: ${{ secrets.KOSLI_API_TOKEN_STAGING }}
  KOSLI_API_TOKEN_PROD: ${{ secrets.KOSLI_API_TOKEN }}
  SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID_BETA }}
  AWS_REGION: ${{ vars.AWS_REGION }}

jobs:
  snyk-scan:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 100

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1-node16
        with:
            role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/gh_actions_snyk_scans
            aws-region: ${{ env.AWS_REGION }}
            role-duration-seconds: 2400
            role-session-name: ${{ github.event.repository.name }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk
        run: |
          # What https://app.kosli.com says is running in aws-prod
          ./snyk_scan_live_artifacts_and_report_to_kosli.sh \
             "${KOSLI_HOST_PROD}" \
             "${KOSLI_API_TOKEN_PROD}" \
             aws-prod

#          # What https://app.kosli.com says is running in aws-beta
#          ./snyk_scan_live_artifacts_and_report_to_kosli.sh \
#             "${KOSLI_HOST_PROD}" \
#             "${KOSLI_API_TOKEN_PROD}" \
#             aws-beta
#
#          # What https://staging.app.kosli.com says is running in aws-prod
#          ./snyk_scan_live_artifacts_and_report_to_kosli.sh \
#             "${KOSLI_HOST_STAGING}" \
#             "${KOSLI_API_TOKEN_STAGING}" \
#             aws-prod
#
#          # What https://staging.app.kosli.com says is running in aws-beta
#          ./snyk_scan_live_artifacts_and_report_to_kosli.sh \
#             "${KOSLI_HOST_STAGING}" \
#             "${KOSLI_API_TOKEN_STAGING}" \
#             aws-beta