From 4ff6190eb1fdc1ea26aa616e13cd926f2a073a8a Mon Sep 17 00:00:00 2001
From: fedy95 <fedy95@protonmail.com>
Date: Mon, 28 Jun 2021 18:49:12 +0000
Subject: [PATCH] add-security-scanners (#9)

https://gitea.fedy95.com/general/dev/issues/56

Reviewed-on: https://gitea.fedy95.com/baseimage/jsonlint/pulls/9
Co-authored-by: fedy95 <fedy95@protonmail.com>
Co-committed-by: fedy95 <fedy95@protonmail.com>
---
 .drone.yml       | 58 ++++++++++++++++++++++++++++++++++++++++++++++++
 image/Dockerfile |  8 ++++---
 2 files changed, 63 insertions(+), 3 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index a97ee9f..3caf6ed 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -16,6 +16,7 @@ steps:
       - yamllint -c /yamllint/relaxed.yaml .
     when:
       event: pull_request
+
   - name: lint json
     image: registry.fedy95.com/baseimage-jsonlint:latest
     commands:
@@ -23,6 +24,63 @@ steps:
     when:
       event: pull_request
 
+  - name: build image
+    image: docker:dind
+    volumes:
+      - name: dockersock
+        path: /var/run/docker.sock
+    environment:
+      REGISTRY: registry.fedy95.com
+    commands:
+      - docker build -t "$REGISTRY"/baseimage-jsonlint:$DRONE_COMMIT_SHA image -f image/Dockerfile
+    when:
+      event: pull_request
+
+  - name: trivy security scan
+    image: aquasec/trivy
+    volumes:
+      - name: dockersock
+        path: /var/run/docker.sock
+    environment:
+      REGISTRY: registry.fedy95.com
+    commands:
+      - "trivy \
+         --exit-code 1 \
+         --format json \
+         --no-progress \
+         $REGISTRY/baseimage-jsonlint:$DRONE_COMMIT_SHA"
+    when:
+      event: pull_request
+
+  - name: grype security scan
+    image: docker:dind
+    volumes:
+      - name: dockersock
+        path: /var/run/docker.sock
+    environment:
+      REGISTRY: registry.fedy95.com
+    commands:
+      - apk add --no-cache curl
+      - "curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | \
+        sh -s -- -b /usr/local/bin"
+      - "grype $REGISTRY/baseimage-jsonlint:$DRONE_COMMIT_SHA \
+         --scope all-layers \
+         --fail-on=critical \
+         --verbose"
+    when:
+      event: pull_request
+
+  - name: cleanup
+    image: docker:dind
+    volumes:
+      - name: dockersock
+        path: /var/run/docker.sock
+    commands:
+      - docker rmi registry.fedy95.com/baseimage-jsonlint:$DRONE_COMMIT_SHA
+    when:
+      event: pull_request
+      status: [ success, failure ]
+
   - name: release
     image: docker:dind
     volumes:
diff --git a/image/Dockerfile b/image/Dockerfile
index 85952d5..15fc50f 100644
--- a/image/Dockerfile
+++ b/image/Dockerfile
@@ -1,10 +1,12 @@
-FROM node:14.16.0-alpine3.13
+FROM node:14-alpine3.13
 
-ARG JSONLINT_VERSION=latest
+ARG JSONLINT_VERSION=1.6.3
 ENV npm_config_loglevel=silent
 
 WORKDIR /data
-RUN npm install -g jsonlint@"$JSONLINT_VERSION" && \
+RUN \
+  apk update && apk upgrade && \
+  npm install -g jsonlint@"$JSONLINT_VERSION" && \
 	rm -rf ~/.npm
 
 USER node