fix: add trivy

.gitlab-ci.yml

@@ -14,6 +14,7 @@ services:
 stages:
   - build_deb
   - docker
+  - scan
   - notification
 
 deb:
@@ -43,13 +44,51 @@ dev_deploy:
   before_script:
     - base64 -d $SA_Development | docker login -u _json_key --password-stdin https://eu.gcr.io
   stage: docker
-  script:
-    - cat /etc/issue
+  script:    
     - docker build -t $IMAGE_TAG .
     - docker push $IMAGE_TAG
   only:
     - master
 
+dev_trivy:
+  image:
+    name: docker.io/aquasec/trivy:latest
+    entrypoint: [""]
+  variables:
+    # No need to clone the repo, we exclusively work on artifacts.  See
+    # https://docs.gitlab.com/ee/ci/runners/README.html#git-strategy
+    GIT_STRATEGY: none
+    TRIVY_USERNAME: ""
+    TRIVY_PASSWORD: ""
+    TRIVY_AUTH_URL: ""
+    FULL_IMAGE_NAME: $IMAGE_TAG
+  stage: scan
+  script:
+    - trivy --version
+    # cache cleanup is needed when scanning images with the same tags, it does not remove the database
+    - time trivy image --clear-cache
+    # update vulnerabilities db
+    - time trivy --download-db-only --no-progress --cache-dir .trivycache/
+    # Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there
+    - time trivy --exit-code 0 --cache-dir .trivycache/ --no-progress --format template --template "@/contrib/gitlab.tpl"
+        --output "$CI_PROJECT_DIR/gl-container-scanning-report.json" "$FULL_IMAGE_NAME"
+    # Prints full report
+    - time trivy --exit-code 0 --cache-dir .trivycache/ --no-progress "$FULL_IMAGE_NAME"
+    # Fail on critical vulnerabilities
+    - time trivy --exit-code 1 --cache-dir .trivycache/ --severity CRITICAL --no-progress "$FULL_IMAGE_NAME"
+  cache:
+    paths:
+      - .trivycache/
+  # Enables https://docs.gitlab.com/ee/user/application_security/container_scanning/ (Container Scanning report is available on GitLab EE Ultimate or GitLab.com Gold)
+  artifacts:
+    when: always
+    reports:
+      container_scanning: gl-container-scanning-report.json
+  only:
+    - master
+
+
+
 prod_deploy:
   before_script:
     - base64 -d $SA_Production | docker login -u _json_key --password-stdin https://eu.gcr.io