diff --git a/container-scan.gitlab-ci.yml b/container-scan.gitlab-ci.yml index d58a9fc..9eb533e 100644 --- a/container-scan.gitlab-ci.yml +++ b/container-scan.gitlab-ci.yml @@ -10,7 +10,7 @@ script: - mvn $MAVEN_CLI_OPTS compile jib:buildTar -DskipTests - ./trivy --cache-dir .trivycache/ --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input target/jib-image.tar - - ./trivy --cache-dir .trivycache/ --exit-code $EXITCODE_ON_HIGH --severity HIGH,CRITICAL --no-progress --auto-refresh --input target/jib-image.tar + - ./trivy --cache-dir .trivycache/ --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input target/jib-image.tar cache: paths: - .trivycache/ @@ -28,24 +28,14 @@ PROJECT_DIR: $CI_PROJECT_DIR DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile CONTEXT_LOCATION: $CI_PROJECT_DIR - IGNORE_UNFIXABLE: "true" EXITCODE: 1 before_script: - wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz script: - /kaniko/executor --context $CONTEXT_LOCATION --dockerfile $DOCKERFILE_LOCATION --cache-dir cache/image --tarPath image.tar --no-push --destination image --skip-tls-verify - - echo $IGNORE_UNFIXABLE - - | - if [[ $IGNORE_UNFIXED == "true" ]] ; then - echo "detect issues, ignore unfixed issues"; - ./trivy --cache-dir .trivycache/ --ignore-unfixed --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar - ./trivy --cache-dir .trivycache/ --ignore-unfixed --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input image.tar - else - echo "detect all issues"; - ./trivy --cache-dir .trivycache/ --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar - ./trivy --cache-dir .trivycache/ --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input image.tar - fi + - ./trivy --cache-dir .trivycache/ --ignore-unfixed --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar + - ./trivy --cache-dir .trivycache/ --ignore-unfixed --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input image.tar cache: paths: