---
kind: secret
name: docker_username
get:
  path: odit-registry-builder
  name: username

---
kind: secret
name: docker_password
get:
  path: odit-registry-builder
  name: password

---
kind: pipeline
type: kubernetes
name: scan:image:pr

trigger:
  event:
    - pull_request

steps:
  - name: build to tar via kaniko
    image: registry.odit.services/library/drone-kaniko
    pull: always
    settings:
      username:
        from_secret: docker_username
      password:
        from_secret: docker_password
      repo: pr/scanme
      tags:
        - latest
      registry: registry.odit.services
      nopush: true
      tarpath: "/drone/src/scanme.tar"
      newrun: true
      snapshot_mode: redo
  - name: scan tar with trivy-offline
    image: quay.io/sighup/trivy-offline:latest
    pull: always
    commands:
      - trivy image --severity MEDIUM,HIGH,CRITICAL --exit-code 1 --skip-update --input /drone/src/scanme.tar