paul/gilde-ci-cd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(Container) add container scan template

Browse Source
This commit is contained in:
Marcel Feix 2021-06-28 10:52:41 +02:00
parent cd2549891a
commit 146ff9b89e
No known key found for this signature in database
GPG Key ID: 04D016E104A25F03
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
container-scan.yml Normal file
View File

@ -0,0 +1,33 @@
.publish-image-jib:
image: $MAVEN_IMAGE
stage: test
variables:
TRIVY_VERSION: 0.18.3
PROJECT_DIR: $CI_PROJECT_DIR
DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile
CONTEXT_LOCATION: $CI_PROJECT_DIR
before_script:
- wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
- tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
script:
- mvn $MAVEN_CLI_OPTS compile jib:buildTar -DskipTests
- ./trivy --exit-code 0 --severity HIGH --no-progress --auto-refresh --input target/jib-image.tar
- ./trivy --exit-code 1 --severity CRITICAL --no-progress --auto-refresh --input target/jib-image.tar
.check-kani:
stage: test
image:
name: gcr.io/kaniko-project/executor:debug
entrypoint: [ "" ]
variables:
TRIVY_VERSION: 0.18.3
PROJECT_DIR: $CI_PROJECT_DIR
DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile
CONTEXT_LOCATION: $CI_PROJECT_DIR
before_script:
- wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
- tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
script:
- /kaniko/executor --context $CONTEXT_LOCATION --dockerfile $DOCKERFILE_LOCATION --cache-dir cache/image --tarPath image.tar --no-push --destination image
- ./trivy --exit-code 0 --severity HIGH --no-progress --auto-refresh --input image.tar
- ./trivy --exit-code 1 --severity CRITICAL --no-progress --auto-refresh --input image.tar