70 lines
3.3 KiB
YAML
70 lines
3.3 KiB
YAML
.scan-container-jib:
|
|
image: $MAVEN_IMAGE
|
|
stage: test
|
|
variables:
|
|
TRIVY_VERSION: 0.23.0
|
|
EXITCODE: 1
|
|
TRIVY_EXTRA_ARGS: "--no-progress --ignore-unfixed"
|
|
before_script:
|
|
- curl -L "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" --output trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
|
|
- tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
|
|
script:
|
|
- mvn $MAVEN_CLI_OPTS compile jib:buildTar -DskipTests
|
|
- ./trivy --timeout 15m --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input target/jib-image.tar
|
|
- ./trivy --timeout 15m --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code $EXITCODE --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --input target/jib-image.tar
|
|
cache:
|
|
paths:
|
|
- .trivycache/
|
|
artifacts:
|
|
reports:
|
|
junit: junit-report.xml
|
|
|
|
.scan-container-jib-gradle:
|
|
image: $GRADLE_IMAGE
|
|
stage: test
|
|
variables:
|
|
TRIVY_VERSION: 0.23.0
|
|
EXITCODE: 1
|
|
PROJECT_DIR: $CI_PROJECT_DIR/build
|
|
TRIVY_EXTRA_ARGS: "--no-progress --ignore-unfixed"
|
|
before_script:
|
|
- export GRADLE_USER_HOME=`pwd`/.gradle
|
|
- curl -L "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" --output trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
|
|
- tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
|
|
script:
|
|
- ./gradlew jibBuildTar -DskipTests
|
|
- ./trivy --timeout 15m --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --format template --template "@contrib/junit.tpl" -o junit-report.xml --input $PROJECT_DIR/jib-image.tar
|
|
- ./trivy --timeout 15m --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code $EXITCODE --cache-dir .trivycache/ --severity HIGH,CRITICAL --no-progress --input $PROJECT_DIR/jib-image.tar
|
|
cache:
|
|
paths:
|
|
- .trivycache/
|
|
artifacts:
|
|
reports:
|
|
junit: junit-report.xml
|
|
|
|
.scan-container-kaniko:
|
|
stage: test
|
|
image:
|
|
name: gcr.io/kaniko-project/executor:debug
|
|
entrypoint: [ "" ]
|
|
variables:
|
|
TRIVY_VERSION: 0.23.0
|
|
PROJECT_DIR: $CI_PROJECT_DIR
|
|
DOCKERFILE_LOCATION: $CI_PROJECT_DIR/Dockerfile
|
|
CONTEXT_LOCATION: $CI_PROJECT_DIR
|
|
EXITCODE: 1
|
|
TRIVY_EXTRA_ARGS: "--no-progress --ignore-unfixed"
|
|
before_script:
|
|
- wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
|
|
- tar zxvf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
|
|
script:
|
|
- /kaniko/executor --context $CONTEXT_LOCATION --dockerfile $DOCKERFILE_LOCATION --cache-dir cache/image --tarPath image.tar --no-push --destination image --skip-tls-verify
|
|
- ./trivy --timeout 15m --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code 0 --cache-dir .trivycache/ --severity HIGH,CRITICAL --format template --template "@contrib/junit.tpl" -o junit-report.xml --input image.tar
|
|
- ./trivy --timeout 15m --cache-dir .trivycache/ $TRIVY_EXTRA_ARGS --exit-code $EXITCODE --cache-dir .trivycache/ --severity HIGH,CRITICAL --input image.tar
|
|
cache:
|
|
paths:
|
|
- .trivycache/
|
|
artifacts:
|
|
reports:
|
|
junit: junit-report.xml
|