CloudBees action: Scan with Snyk Container

Use this action to scan image binaries with the Snyk Container scanner, to identify and remediate security vulnerabilities before deployment.

All CloudBees action repositories are listed at CloudBees, Inc. on GitHub.

Inputs

Table 1. Input details
Input name	Data type	Required?	Description
`orgname`	String	Yes	The Snyk Container username.
`token`	String	Yes	The Snyk Container client secret.
`image-location`	String	Yes	The container image location.
`image-tag`	String	Yes	The container image tag.

Usage example

In your YAML file, add:

      - name: Scan with Snyk Container
        uses: https://github.com/cloudbees-io/snyk-scan-container@v1
        with:
          orgname: "snyk_username"
          token: ${{ secrets.SNYK_SECRET }}
          image-location: ${{ vars.SNYK_ASSET_IDENTIFIER }}
          image-tag: ${{ vars.SNYK_PROFILE_IDENTIFIER }}▼

Example: Scan a container image using Snyk

Integrate Snyk with CloudBees platform workflows to proactively identify and remediate vulnerabilities before deployment, improving security and compliance.

Prerequisites

Before using this action, ensure you have:

A Snyk API token (available from the Snyk dashboard).
A Docker image that needs scanning.
CloudBees workflows integrated with Snyk scanning actions.

Review the CloudBees actions documentation for integration information.

Scan container images in a CloudBees workflow

The following example demonstrates how to scan a container image for vulnerabilities as part of a CloudBees workflow:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Scan with Snyk Container
        uses: https://github.com/cloudbees-io/snyk-scan-container@v1
        with:
          orgname: "snyk_username"
          token: ${{ secrets.SNYK_SECRET }}
          image-location: ${{ vars.SNYK_ASSET_IDENTIFIER }}
          image-tag: ${{ vars.SNYK_PROFILE_IDENTIFIER }}▼

Interpret scan results

After execution, Snyk generates a vulnerability report that includes:

Severity levels (critical, high, medium, low).
CVE identifiers for known vulnerabilities.
Suggested remediation steps, such as upgrading dependencies.

Automate security checks

To enforce security policies, configure the workflow to fail the build if high-severity vulnerabilities are detected. For example:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Scan and block deployment if critical issues found
        uses: https://github.com/cloudbees-io/snyk-scan-container@v1
        with:
          orgname: "snyk_username"
          token: ${{ secrets.SNYK_SECRET }}
          image-location: ${{ vars.SNYK_ASSET_IDENTIFIER }}
          image-tag: ${{ vars.SNYK_PROFILE_IDENTIFIER }}

      - name: Enforce security policy
        run: snyk Container test my-app:latest --fail-on=high || exit 1▼