Snyk Docker Action
This page provides instructions for and examples of using the Snyk GitHub Action for Docker. For general instructions and information see GitHub Actions integration.
In order to use the Docker Action, you must have a Snyk API token. See Getting Your Snyk Token, or you can sign up for free.
Using the Snyk Docker Action to check for vulnerabilities
You can use the Snyk Docker Action to check for vulnerabilities in your Docker images as follows:
Snyk Docker Action properties
The Snyk Docker Action has properties which are passed to the underlying image. These are passed to the action using with
.
For example, You can use the Snyk Docker Action to check for only high severity vulnerabilities as follows:
Uploading Snyk scan results to GitHub Code Scanning using the Snyk Docker Action
The Docker Action also supports integrating with GitHub Code Scanning and can show issues in the GitHub Security tab. As long as you reference a Dockerfile with --file=Dockerfile
in the args
, a snyk.sarif
file will be generated which can be uploaded to GitHub Code Scanning.
To use the upload-sarif option for private repos you must have GitHub Advanced Security.
If you see the error Advanced Security must be enabled for this repository to use code scanning
, check that GitHub Advanced Security is enabled. For more information, see "Managing security and analysis settings for your repository."
Last updated