paul/gilde-ci-cd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(cve): by default mute errors we cannot fix

Browse Source
This commit is contained in:
Fabian Widmann 2021-07-23 13:50:55 +02:00
parent e0dbec82a9
commit 12ff4bcfd0
1 changed files with 3 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
container-scan.gitlab-ci.yml
View File

@ -10,7 +10,7 @@
script:
- mvn $MAVEN_CLI_OPTS compile jib:buildTar -DskipTests
- ./trivy --cache-dir .trivycache/ --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input target/jib-image.tar
- ./trivy --cache-dir .trivycache/ --exit-code $EXITCODE_ON_HIGH --severity HIGH,CRITICAL --no-progress --auto-refresh --input target/jib-image.tar
- ./trivy --cache-dir .trivycache/ --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input target/jib-image.tar
cache:
paths:
- .trivycache/
@ -28,24 +28,14 @@
PROJECT_DIR: $CI_PROJECT_DIR
DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile
CONTEXT_LOCATION: $CI_PROJECT_DIR
IGNORE_UNFIXABLE: "true"
EXITCODE: 1
before_script:
- wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
- tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
script:
- /kaniko/executor --context $CONTEXT_LOCATION --dockerfile $DOCKERFILE_LOCATION --cache-dir cache/image --tarPath image.tar --no-push --destination image --skip-tls-verify
- echo $IGNORE_UNFIXABLE
- |
if [[ $IGNORE_UNFIXED == "true" ]] ; then
echo "detect issues, ignore unfixed issues";
./trivy --cache-dir .trivycache/ --ignore-unfixed --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar
./trivy --cache-dir .trivycache/ --ignore-unfixed --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input image.tar
else
echo "detect all issues";
./trivy --cache-dir .trivycache/ --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar
./trivy --cache-dir .trivycache/ --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input image.tar
fi
- ./trivy --cache-dir .trivycache/ --ignore-unfixed --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar
- ./trivy --cache-dir .trivycache/ --ignore-unfixed --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input image.tar
cache:
paths: