add-grype

.drone.yml

@@ -29,32 +29,32 @@ steps:
     when:
       event: pull_request
 
-#  - name: trivy security check
-#    image: aquasec/trivy
-#    volumes:
-#      - name: dockersock
-#        path: /var/run/docker.sock
-#    environment:
-#      REGISTRY: registry.fedy95.com
-#    commands:
-#      - "trivy \
-#         --exit-code 1 \
-#         --format json \
-#         --no-progress \
-#         $REGISTRY/baseimage-yamllint:$DRONE_COMMIT_SHA"
-#    when:
-#      event: pull_request
+  - name: trivy security check
+    image: aquasec/trivy
+    volumes:
+      - name: dockersock
+        path: /var/run/docker.sock
+    environment:
+      REGISTRY: registry.fedy95.com
+    commands:
+      - "trivy \
+         --exit-code 1 \
+         --format json \
+         --no-progress \
+         $REGISTRY/baseimage-yamllint:$DRONE_COMMIT_SHA"
+    when:
+      event: pull_request
 
   - name: grype security check
-    image: anchore/grype
-#    volumes:
-#      - name: dockersock
-#        path: /var/run/docker.sock
-#    environment:
-#      REGISTRY: registry.fedy95.com
+    image: docker:dind
+    volumes:
+      - name: dockersock
+        path: /var/run/docker.sock
+    environment:
+      REGISTRY: registry.fedy95.com
     commands:
-#      - "grype $REGISTRY/baseimage-yamllint:$DRONE_COMMIT_SHA --scope all-layers --fail-on=critical"
-      - sleep 20
+      - curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
+      - "grype $REGISTRY/baseimage-yamllint:$DRONE_COMMIT_SHA --scope all-layers --fail-on=critical"
     when:
       event: pull_request