diff --git a/drone/test_trivy_image_scan.yaml b/drone/test_trivy_image_scan.yaml
new file mode 100644
index 0000000..100daa1
--- /dev/null
+++ b/drone/test_trivy_image_scan.yaml
@@ -0,0 +1,42 @@
+---
+kind: secret
+name: docker_username
+get:
+  path: odit-registry-builder
+  name: username
+
+---
+kind: secret
+name: docker_password
+get:
+  path: odit-registry-builder
+  name: password
+
+---
+kind: pipeline
+type: kubernetes
+name: scan:image:pr
+
+trigger:
+  event:
+    - pull_request
+
+steps:
+  - name: build to tar via kaniko
+    image: registry.odit.services/library/drone-kaniko
+    settings:
+      username:
+        from_secret: docker_username
+      password:
+        from_secret: docker_password
+      repo: pr/scanme
+      tags:
+        - latest
+      registry: registry.odit.services
+      nopush: true
+      tarpath: "/drone/src/scanme.tar"
+  - name: scan tar with trivy-offline
+    image: quay.io/sighup/trivy-offline:latest
+    pull: always
+    commands:
+      - trivy image --severity MEDIUM,HIGH,CRITICAL --exit-code 1 --skip-update --input /drone/src/scanme.tar