Snyk take2

.github/workflows/snyk.yml

@@ -9,16 +9,60 @@ on:
   schedule:
     - cron: '30 22 * * 5'
 
-permissions:
-  contents: read
-
 jobs:
+
+  build_image:
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_REGISTRY: ghcr.io
+    strategy:
+      fail-fast: false
+      matrix:
+        config:
+          - {name: base-r}
+          - {name: base-r-alpine}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Log in to the Container registry 📦
+        uses: docker/[email protected]
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Set up Docker Buildx
+        uses: docker/[email protected]
+      - name: Prepare tags
+        id: docker_meta
+        uses: docker/[email protected]
+        with:
+          images: rapporteket/${{ matrix.config.name }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=schedule,pattern=weekly
+            type=semver,pattern={{version}}
+      - name: Build and push docker image
+        uses: docker/[email protected]
+        with:
+          context: ./${{ matrix.config.name }}/.
+          file: ./${{ matrix.config.name }}/Dockerfile
+          push: true
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
   snyk:
     permissions:
-      contents: read # for actions/checkout to fetch code
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
+      id-token: write
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
+    needs: [ build_image ]
+    env:
+      GITHUB_REGISTRY: ghcr.io
     strategy:
         fail-fast: false
         matrix:
@@ -28,27 +72,24 @@ jobs:
     name: ${{ matrix.config.name }}
     steps:
     - uses: actions/checkout@v4
-    - name: Set up Docker Buildx
-      uses: docker/[email protected]
-    - name: Build docker image
-      uses: docker/[email protected]
+    - name: Prepare tags
+      id: docker_meta
+      uses: docker/[email protected]
       with:
-        context: ./${{ matrix.config.name }}/.
-        file: ./${{ matrix.config.name }}/Dockerfile
-        push: false
-        tags: rapporteket/${{ matrix.config.name }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
+        images: rapporteket/${{ matrix.config.name }}
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=schedule,pattern=weekly
+          type=semver,pattern={{version}}
     - name: Run Snyk to check Docker image for vulnerabilities
-      # Snyk can be used to break the build when it detects vulnerabilities.
-      # In this case we want to upload the issues to GitHub Code Scanning
       continue-on-error: true
       uses: snyk/actions/docker@master
       env:
         SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
       with:
-        image: rapporteket/${{ matrix.config.name }}
-        args: --file=${{ matrix.config.name }}/Dockerfile --severity-threshold=critical
+        image: ${{ steps.docker_meta.outputs.tags }}
+        args: --file=${{ matrix.config.name }}/Dockerfile --severity-threshold=critical --sarif-file-output=snyk.sarif
     - name: Upload result to GitHub Code Scanning
       uses: github/codeql-action/upload-sarif@v3
       with:
@@ -60,13 +101,13 @@ jobs:
         SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
       with:
         command: monitor
-        image: rapporteket/${{ matrix.config.name }}
+        image: ${{ steps.docker_meta.outputs.tags }}
         args: --file=${{ matrix.config.name }}/Dockerfile --severity-threshold=critical --org=b034af62-43be-40c7-95e8-fdc56d6f3092
-    - name: Accept only vulnerability levels below critical 
+    - name: Accept only vulnerability levels below high 
       continue-on-error: false
       uses: snyk/actions/docker@master
       env:
         SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
       with:
-        image: rapporteket/${{ matrix.config.name }}
-        args: --file=${{ matrix.config.name }}/Dockerfile --severity-threshold=critical
+        image: ${{ steps.docker_meta.outputs.tags }}
+        args: --file=${{ matrix.config.name }}/Dockerfile --severity-threshold=high