paul/gilde-ci-cd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'feat/allow_ignoring_unfixable_cve' into 'master'

Browse Source 
Feat/allow ignoring unfixable cve

See merge request gilden/ci/gitlab-ci-templates!18
This commit is contained in:
Marcel Feix 2021-07-23 12:24:39 +00:00
commit cb749530bf
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
container-scan.gitlab-ci.yml
View File

@ -4,13 +4,14 @@
variables: variables:
TRIVY_VERSION: 0.18.3 TRIVY_VERSION: 0.18.3
EXITCODE: 1 EXITCODE: 1
TRIVY_EXTRA_ARGS: "--no-progress --auto-refresh --ignore-unfixed"
before_script: before_script:
- curl -L "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" --output trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz - curl -L "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" --output trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
- tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
script: script:
- mvn $MAVEN_CLI_OPTS compile jib:buildTar -DskipTests - mvn $MAVEN_CLI_OPTS compile jib:buildTar -DskipTests
- ./trivy --cache-dir .trivycache/ --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input target/jib-image.tar - ./trivy --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input target/jib-image.tar
- ./trivy --cache-dir .trivycache/ --exit-code $EXITCODE_ON_HIGH --severity HIGH,CRITICAL --no-progress --auto-refresh --input target/jib-image.tar - ./trivy --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code $EXITCODE --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --input target/jib-image.tar
cache: cache:
paths: paths:
- .trivycache/ - .trivycache/
@ -29,14 +30,14 @@
DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile
CONTEXT_LOCATION: $CI_PROJECT_DIR CONTEXT_LOCATION: $CI_PROJECT_DIR
EXITCODE: 1 EXITCODE: 1
TRIVY_EXTRA_ARGS: "--no-progress --auto-refresh --ignore-unfixed"
before_script: before_script:
- wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" - wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
- tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
script: script:
- /kaniko/executor --context $CONTEXT_LOCATION --dockerfile $DOCKERFILE_LOCATION --cache-dir cache/image --tarPath image.tar --no-push --destination image --skip-tls-verify - /kaniko/executor --context $CONTEXT_LOCATION --dockerfile $DOCKERFILE_LOCATION --cache-dir cache/image --tarPath image.tar --no-push --destination image --skip-tls-verify
- ./trivy --cache-dir .trivycache/ --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar - ./trivy --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar
- ./trivy --cache-dir .trivycache/ --exit-code $EXITCODE --severity HIGH,CRITICAL --no-progress --auto-refresh --input image.tar - ./trivy --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code $EXITCODE --cache-dir .trivycache/ --severity HIGH,CRITICAL --input image.tar
cache: cache:
paths: paths:
- .trivycache/ - .trivycache/