46 lines
931 B
YAML
46 lines
931 B
YAML
---
|
|
kind: secret
|
|
name: docker_username
|
|
get:
|
|
path: odit-registry-builder
|
|
name: username
|
|
|
|
---
|
|
kind: secret
|
|
name: docker_password
|
|
get:
|
|
path: odit-registry-builder
|
|
name: password
|
|
|
|
---
|
|
kind: pipeline
|
|
type: kubernetes
|
|
name: scan:image:pr
|
|
|
|
trigger:
|
|
event:
|
|
- pull_request
|
|
|
|
steps:
|
|
- name: build to tar via kaniko
|
|
image: registry.odit.services/library/drone-kaniko
|
|
pull: always
|
|
settings:
|
|
username:
|
|
from_secret: docker_username
|
|
password:
|
|
from_secret: docker_password
|
|
repo: pr/scanme
|
|
tags:
|
|
- latest
|
|
registry: registry.odit.services
|
|
nopush: true
|
|
tarpath: "/drone/src/scanme.tar"
|
|
newrun: true
|
|
snapshot_mode: redo
|
|
- name: scan tar with trivy-offline
|
|
image: quay.io/sighup/trivy-offline:latest
|
|
pull: always
|
|
commands:
|
|
- trivy image --severity MEDIUM,HIGH,CRITICAL --exit-code 1 --skip-update --input /drone/src/scanme.tar
|