.scan-container-jib:
  image: $MAVEN_IMAGE
  stage: test
  variables:
    TRIVY_VERSION: 0.24.0
    EXITCODE: 1
    TRIVY_EXTRA_ARGS: "--no-progress --ignore-unfixed"
  before_script:
    - curl -L "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"  --output trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
    - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
  script:
    - mvn $MAVEN_CLI_OPTS compile jib:buildTar -DskipTests
    - ./trivy --cache-dir .trivycache/ image --timeout 15m $TRIVY_EXTRA_ARGS --exit-code 0 --severity HIGH,CRITICAL --format template --template "@contrib/junit.tpl" -o junit-report.xml --input target/jib-image.tar
    - ./trivy --cache-dir .trivycache/ image --timeout 15m $TRIVY_EXTRA_ARGS --exit-code $EXITCODE --severity HIGH,CRITICAL --input target/jib-image.tar
  cache:
    paths:
      - .trivycache/
  artifacts:
    reports:
      junit: junit-report.xml

.scan-container-jib-gradle:
  image: $GRADLE_IMAGE
  stage: test
  variables:
    TRIVY_VERSION: 0.24.0
    EXITCODE: 1
    PROJECT_DIR: $CI_PROJECT_DIR/build
    TRIVY_EXTRA_ARGS: "--no-progress --ignore-unfixed"
  before_script:
    - export GRADLE_USER_HOME=`pwd`/.gradle
    - curl -L "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"  --output trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
    - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
  script:
    - ./gradlew jibBuildTar -DskipTests
    - ./trivy --cache-dir .trivycache/ image --timeout 15m  $TRIVY_EXTRA_ARGS --exit-code 0 --severity HIGH,CRITICAL --format template --template "@contrib/junit.tpl" -o junit-report.xml --input $PROJECT_DIR/jib-image.tar
    - ./trivy --cache-dir .trivycache/ image --timeout 15m  $TRIVY_EXTRA_ARGS --exit-code $EXITCODE --severity HIGH,CRITICAL --input $PROJECT_DIR/jib-image.tar
  cache:
    paths:
      - .trivycache/
  artifacts:
    reports:
      junit: junit-report.xml

.scan-container-kaniko:
  stage: test
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [ "" ]
  variables:
    TRIVY_VERSION: 0.24.0
    PROJECT_DIR: $CI_PROJECT_DIR
    DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile
    CONTEXT_LOCATION: $CI_PROJECT_DIR
    EXITCODE: 1
    TRIVY_EXTRA_ARGS: "--no-progress --ignore-unfixed"
  before_script:
    - wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
    - tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
  script:
    - /kaniko/executor --context $CONTEXT_LOCATION --dockerfile $DOCKERFILE_LOCATION --cache-dir cache/image --tarPath  image.tar --no-push --destination image --skip-tls-verify
    - ./trivy --cache-dir .trivycache/ image --timeout 15m  $TRIVY_EXTRA_ARGS --exit-code 0 --severity HIGH,CRITICAL --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar
    - ./trivy --cache-dir .trivycache/ image --timeout 15m  $TRIVY_EXTRA_ARGS --exit-code $EXITCODE --severity HIGH,CRITICAL  --input image.tar
  cache:
    paths:
      - .trivycache/
  artifacts:
    reports:
      junit: junit-report.xml