|
|
|
@ -29,7 +29,7 @@ steps: |
|
|
|
when: |
|
|
|
event: pull_request |
|
|
|
|
|
|
|
- name: trivy |
|
|
|
- name: trivy security scan |
|
|
|
image: aquasec/trivy |
|
|
|
volumes: |
|
|
|
- name: dockersock |
|
|
|
@ -45,7 +45,7 @@ steps: |
|
|
|
when: |
|
|
|
event: pull_request |
|
|
|
|
|
|
|
- name: grype |
|
|
|
- name: grype security scan |
|
|
|
image: docker:dind |
|
|
|
volumes: |
|
|
|
- name: dockersock |
|
|
|
@ -55,7 +55,7 @@ steps: |
|
|
|
commands: |
|
|
|
- apk add --no-cache curl |
|
|
|
- "curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | \ |
|
|
|
sh -s -- -b /usr/local/bin" |
|
|
|
sh -s -- -b /usr/local/bin" |
|
|
|
- "grype $REGISTRY/baseimage-yamllint:$DRONE_COMMIT_SHA \ |
|
|
|
--scope all-layers \ |
|
|
|
--fail-on=critical \ |
|
|
|
@ -72,7 +72,6 @@ steps: |
|
|
|
- docker rmi registry.fedy95.com/baseimage-yamllint:$DRONE_COMMIT_SHA |
|
|
|
when: |
|
|
|
event: pull_request |
|
|
|
depends_on: [trivy, grype] |
|
|
|
|
|
|
|
- name: release |
|
|
|
image: docker:dind |
|
|
|
|
