diff --git a/container-scan.yml b/container-scan.yml index 244f3dc..4c246e8 100644 --- a/container-scan.yml +++ b/container-scan.yml @@ -6,14 +6,16 @@ PROJECT_DIR: $CI_PROJECT_DIR DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile CONTEXT_LOCATION: $CI_PROJECT_DIR + EXITCODE_ON_HIGH: 1 + EXITCODE_ON_CRITICAL: 1 before_script: - curl -L "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" --output trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz script: - mvn $MAVEN_CLI_OPTS compile jib:buildTar -DskipTests - - ./trivy --exit-code 0 --severity HIGH --no-progress --auto-refresh --input target/jib-image.tar - - ./trivy --exit-code 1 --severity CRITICAL --no-progress --auto-refresh --input target/jib-image.tar - + - ./trivy --exit-code $EXITCODE_ON_HIGH --severity HIGH --no-progress --auto-refresh --input target/jib-image.tar + - ./trivy --exit-code $EXITCODE_ON_CRITICAL --severity CRITICAL --no-progress --auto-refresh --input target/jib-image.tar + .scan-container-kaniko: stage: test image: @@ -24,10 +26,12 @@ PROJECT_DIR: $CI_PROJECT_DIR DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile CONTEXT_LOCATION: $CI_PROJECT_DIR + EXITCODE_ON_HIGH: 1 + EXITCODE_ON_CRITICAL: 1 before_script: - wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz script: - /kaniko/executor --context $CONTEXT_LOCATION --dockerfile $DOCKERFILE_LOCATION --cache-dir cache/image --tarPath image.tar --no-push --destination image - - ./trivy --exit-code 0 --severity HIGH --no-progress --auto-refresh --input image.tar - - ./trivy --exit-code 1 --severity CRITICAL --no-progress --auto-refresh --input image.tar \ No newline at end of file + - ./trivy --exit-code $EXITCODE_ON_HIGH --severity HIGH --no-progress --auto-refresh --input image.tar + - ./trivy --exit-code $EXITCODE_ON_CRITICAL --severity CRITICAL --no-progress --auto-refresh --input image.tar