Merge pull request #8 from patoarvizu/add_snyk_remediations

Add snyk remediations

.circleci/config.yml

@@ -1,5 +1,8 @@
 version: 2.1
 
+orbs:
+  snyk: snyk/[email protected]
+
 jobs:
   build:
     machine:
@@ -30,6 +33,16 @@ jobs:
             curl -L https://github.com/theupdateframework/notary/releases/download/v${NOTARY_VERSION}/notary-Linux-amd64 -o notary
             chmod +x notary
             sudo mv notary /usr/local/bin
+      - run:
+          name: Build image
+          command: |
+            go mod vendor
+            docker build -t patoarvizu/vault-agent-auto-inject-webhook:latest .
+      - snyk/scan:
+          docker-image-name: patoarvizu/vault-agent-auto-inject-webhook:latest
+          fail-on-issues: true
+          project: patoarvizu/vault-agent-auto-inject-webhook
+          severity-threshold: low
       - run:
           name: Build webhook
           command: |
@@ -38,7 +51,6 @@ jobs:
             export NOTARY_DELEGATION_PASSPHRASE=$NOTARY_ROLE_PASSPHRASE
             notary -s https://notary.docker.io -d ~/.docker/trust key import ${HOME}/vault-agent-auto-inject-webhook-circleci.key --role vault-agent-auto-inject-webhook-circleci
             export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE=$NOTARY_DELEGATION_PASSPHRASE
-            go mod vendor
             DOCKER_BUILD_ARGS="--build-arg GIT_COMMIT=$CIRCLE_SHA1 --build-arg GIT_TAG=$CIRCLE_TAG --build-arg COMMIT_TIMESTAMP=$(git log -1 --format=%at) --build-arg AUTHOR_EMAIL=$(git log -1 --format=%ae) --build-arg SIGNATURE_KEY=$(git log -1 --format=%GK)"
             docker build $DOCKER_BUILD_ARGS -t patoarvizu/vault-agent-auto-inject-webhook:$CIRCLE_SHA1 .
             export DOCKER_CONTENT_TRUST=1
@@ -58,6 +70,7 @@ workflows:
   build-webhook:
     jobs:
       - build:
+          context: authentication-tokens
           filters:
             tags:
               only: /^v\d+\.\d+.\d+$/

Dockerfile

@@ -6,7 +6,7 @@ WORKDIR /go/src/github.com/patoarvizu/vault-agent-auto-inject-webhook/
 
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /vault-agent-auto-inject-webhook /go/src/github.com/patoarvizu/vault-agent-auto-inject-webhook/cmd/webhook.go
 
-FROM alpine:3.9
+FROM alpine:3.11.3
 
 ARG GIT_COMMIT="unspecified"
 LABEL GIT_COMMIT=$GIT_COMMIT