Skip to content
Snippets Groups Projects
Commit 86eb251b authored by Joost Hemmen's avatar Joost Hemmen :basketball:
Browse files

remove redundant scan job

parent a13c087d
No related branches found
No related tags found
1 merge request!243Resolve "Document CVEs of images used in docker compose setup"
Pipeline #487710 failed
......@@ -81,36 +81,5 @@ database-test:
- "sleep 20"
script:
- "PGPASSWORD=postgres psql -U postgres -d postgres -h docker -tAc \"SELECT version()\" || exit 1"
tags:
- "dind"
docker-image-scan:
image: "docker:${DOCKER_IMAGE_TAG}"
stage: "scan"
variables:
TRIVY_DISABLE_VEX_NOTICE: "true"
before_script:
# Install Trivy in the pipeline environment
- "apk add --no-cache curl"
- "curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.58.2"
- "cp .env.example .env"
script:
- "docker compose pull -q"
- "docker compose build -q"
- |
for image in $(docker images --format "{{.Repository}}:{{.Tag}}"); do
echo "Scanning $image";
trivy image $image -q --severity CRITICAL >> critical_all.cve;
trivy image $image -q --severity CRITICAL --ignore-unfixed >> critical_fixed.cve;
trivy image $image -q --severity HIGH >> high_all.cve;
trivy image $image -q --severity HIGH --ignore-unfixed >> high_fixed.cve;
done
artifacts:
paths:
- "*.cve"
expire_in: 30 days
rules:
- if: '$CI_COMMIT_BRANCH != "main" && $CI_PIPELINE_SOURCE == "push"'
when: always
tags:
- "dind"
\ No newline at end of file
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment