Trivy: gitlab-ci.yaml template is incorrect

[webmutation]

Hi,

The gitlab template on the readme is incorrect and will not validate. There is no directories in gitlab-ci.yaml

I think this is probably more inline with normal gitlab-ci.yaml

stages:
  - test

trivy:
  stage: test
  image: docker:stable
  services:
    - name: docker:dind
      entrypoint: ["env", "-u", "DOCKER_HOST"]
      command: ["dockerd-entrypoint.sh"]
  variables:
    DOCKER_HOST: tcp://docker:2375/
    DOCKER_DRIVER: overlay2
    # See https://github.com/docker-library/docker/pull/166
    DOCKER_TLS_CERTDIR: ""
  before_script:
    - apk add --no-cache curl
    - export VERSION=$(curl --silent "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
    - echo $VERSION
    - wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz
    - tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz
  variables:
    DOCKER_DRIVER: overlay2
  allow_failure: true
  services:
    - docker:stable-dind
  script:
    - ./trivy --exit-code 0 --cache-dir $CI_PROJECT_DIR/.trivycache/ --no-progress --severity HIGH DOCKER_IMAGE
    #- ./trivy --exit-code 1 --severity CRITICAL  --no-progress DOCKER_IMAGE
  cache:
    paths:
      - $CI_PROJECT_DIR/.trivycache/

The above example is working and is tested.

[knqyf263]

Would you send a PR?

[webmutation]

Sure! will do that ASAP

[marcinbojko]

Not sure if it's related, but I just switched to 0.2.0 in gitlab CI (not using mentioned cache solution). Now all scans are executed within 1 second and result is always 'null'.
Doing this manually (via docker run -it docker-dind) scan is conducted properly.
I've tried briefly with solution above (cache dir) but i can see no changes.

[webmutation]

Not related... it takes one minute to scan usually... remember to put your docker image.
I can attach the scan results from this.

[marcinbojko]

Yes, manually it takes same amount.

[4x0v7]

Hi everyone! Just wanted to chime in here, this is what I do in .gitlab-ci.yml
This has been working well so far for me

stages:
  - build
  - test

variables:
  CONTAINER_IMAGE: registry.gitlab.com/username/repo
  DOCKER_VERSION: 19.03.4

.dind: &dind-template
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  image: docker:${DOCKER_VERSION}
  services:
    - name: docker:${DOCKER_VERSION}-dind

# Build and save the Docker image
build-the-dockerfile:
  stage: build
  <<: *dind-template
  before_script:
    - docker version
  script:
    - docker build --tag $CONTAINER_IMAGE .
    - mkdir image
    - docker save $CONTAINER_IMAGE > image/${CI_COMMIT_SHORT_SHA}.tar
  artifacts:
    paths:
      - image
    expire_in: 1 hour

# Scan with Trivy
container-scan:
  stage: test
  <<: *dind-template
  variables:
    TRIVY_RELEASE_URL: https://api.github.com/repos/aquasecurity/trivy/releases/latest
  before_script:
    - docker load -i image/${CI_COMMIT_SHORT_SHA}.tar
  script:
    - apk add coreutils git grep jq tar wget
    - echo "Latest Trivy version is $(wget -q -O- ${TRIVY_RELEASE_URL} | jq -r .tag_name)"
    - >
      wget --no-verbose --show-progress $(
        wget -q -O- ${TRIVY_RELEASE_URL} |
        jq -r .assets[].browser_download_url |
        grep Linux-64bit.tar
      )
    - >
      wget -q -O- ${TRIVY_RELEASE_URL} |
      jq -r .assets[].browser_download_url |
      grep checksums |
      wget -q -i- -O- |
      sha256sum --ignore-missing -c -
    - tar -xzf trivy_*_Linux-64bit.tar.gz -C /usr/local/bin trivy
    - trivy --version
    - trivy --exit-code 0 --severity HIGH --no-progress $CONTAINER_IMAGE
    - trivy --exit-code 1 --severity CRITICAL --no-progress $CONTAINER_IMAGE

[webmutation]

That will work as well... the template i submitted tries to follow the same generic principle like the others already there.

But if anyone want a build docker image and not push it, that would work :)

[knqyf263]

@4x0v7 It seems nice! I will also add your config. I may prepare an example dir for CI/CD.

[webmutation]

@knqyf263 if you can wait until Monday night ill send new pull request to readme and to the trivy ci repo to support gitlab along with existing travis and circle

[knqyf263]

@webmutation I can wait for it 👍 Thanks!

[webmutation]

Hi @knqyf263 I created pull request, execution result is here.
https://gitlab.com/danielmd3000/trivy-ci-test/-/jobs/354882201

I don't know if a aquasecurity gitlab project exists, but now you can enable in 3 different build systems.