ci: improve Jenkinsfile
This commit is contained in:
parent
e0747db61d
commit
26233b1eda
2
.gitignore
vendored
Normal file
2
.gitignore
vendored
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
trivy-report.html
|
||||||
|
image.tar
|
@ -23,7 +23,7 @@ RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
|
|||||||
/var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock
|
/var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock
|
||||||
|
|
||||||
# Trivy html template
|
# Trivy html template
|
||||||
ADD --chown=jenkins:jenkins html.tpl /home/jenkins/
|
ADD --chown=jenkins:jenkins html.tpl /home/jenkins/agent
|
||||||
|
|
||||||
# Make docker in Jenkinsfiles work
|
# Make docker in Jenkinsfiles work
|
||||||
RUN ln -s /usr/bin/podman /usr/bin/docker
|
RUN ln -s /usr/bin/podman /usr/bin/docker
|
||||||
|
39
Jenkinsfile
vendored
Normal file
39
Jenkinsfile
vendored
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
pipeline {
|
||||||
|
agent { node { label 'podman && trivy && aws' } }
|
||||||
|
stages {
|
||||||
|
stage('Build'){
|
||||||
|
steps {
|
||||||
|
sh 'make build'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
stage('Scan'){
|
||||||
|
environment {
|
||||||
|
TRIVY_TEMPLATE = "@${env.WORKSPACE}/html.tpl"
|
||||||
|
TRIVY_FORMAT = "template"
|
||||||
|
TRIVY_OUTPUT = "reports/trivy.html"
|
||||||
|
}
|
||||||
|
steps {
|
||||||
|
// Scan via trivy
|
||||||
|
sh 'mkdir -p reports'
|
||||||
|
sh 'make scan'
|
||||||
|
publishHTML target : [
|
||||||
|
allowMissing: true,
|
||||||
|
alwaysLinkToLastBuild: true,
|
||||||
|
keepAll: true,
|
||||||
|
reportDir: 'reports',
|
||||||
|
reportFiles: 'trivy.html',
|
||||||
|
reportName: 'Trivy Scan',
|
||||||
|
reportTitles: 'Trivy Scan'
|
||||||
|
]
|
||||||
|
|
||||||
|
// Scan again and fail on CRITICAL vulns
|
||||||
|
sh 'TRIVY_EXIT_CODE=1 TRIVY_SEVERITY=CRITICAL make scan'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
stage('Push'){
|
||||||
|
steps {
|
||||||
|
sh 'make push'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
9
Makefile
9
Makefile
@ -4,7 +4,7 @@ REGISTRY := public.ecr.aws/zero-downtime
|
|||||||
REPOSITORY := jenkins-podman
|
REPOSITORY := jenkins-podman
|
||||||
TAG := $(REPOSITORY):v$(VERSION)
|
TAG := $(REPOSITORY):v$(VERSION)
|
||||||
|
|
||||||
.PHONY: build push clean
|
.PHONY: build push clean scan
|
||||||
|
|
||||||
all: build
|
all: build
|
||||||
|
|
||||||
@ -17,9 +17,8 @@ push:
|
|||||||
podman push $(REGISTRY)/$(TAG)
|
podman push $(REGISTRY)/$(TAG)
|
||||||
|
|
||||||
clean:
|
clean:
|
||||||
podman rmi -f $(TAG)
|
rm -f image.tar trivy-report.html
|
||||||
|
|
||||||
scan:
|
scan:
|
||||||
podman save $(TAG) -o image.tar
|
[ -f image.tar ] || podman save $(TAG) -o image.tar
|
||||||
trivy image --input image.tar --format template --template @./html.tpl -o report.html
|
trivy image --input image.tar
|
||||||
rm -f image.tar
|
|
||||||
|
Loading…
Reference in New Issue
Block a user