Skip to content

Commit f6a3ffc

Browse files
committed
ci(pipeline.yml): #106 fix sast jobs in github actions
1 parent ae40d5d commit f6a3ffc

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

.github/workflows/pipeline.yml

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,17 +90,22 @@ jobs:
9090
steps:
9191
- uses: actions/checkout@v4
9292
- name: Run Snyk to static code analysis for vulnerabilities
93-
uses: snyk/actions/node@master
93+
uses: snyk/actions/maven-3-jdk-21@master
9494
env:
95-
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}§
96-
sast-dockerfile-trivy:
95+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
96+
sast-dockerfile-trivy-hadolint:
9797
runs-on: ubuntu-latest
9898
needs: build
9999
steps:
100100
- uses: actions/checkout@v4
101+
- uses: hadolint/[email protected]
102+
with:
103+
dockerfile: Dockerfile
104+
failure-threshold: error
101105
- name: Run Trivy vulnerability scanner in IaC mode
102106
uses: aquasecurity/[email protected]
103107
with:
104-
scan-type: 'config'
108+
scan-type: config
109+
scanners: misconfig
105110
exit-code: '1'
106111
severity: 'CRITICAL,HIGH'

0 commit comments

Comments
 (0)