fix: use trivy from vnc-runner

.gitlab-ci.yml

@@ -44,30 +44,30 @@ dev_deploy:
   before_script:
     - base64 -d $SA_Development | docker login -u _json_key --password-stdin https://eu.gcr.io
   stage: docker
+  artifacts:
+    public: false
+    expire_in: 12h
+    paths:
+      - scan
   script:
     - docker build -t $IMAGE_TAG .
     - docker push $IMAGE_TAG
+    - mkdir -p
+    - docker image save $IMAGE_TAG -o scan/hybridauth.tgz
   only:
     - master
 
 dev_trivy:
-  image:
+  image: eu.gcr.io/vnc-development/docker-vnc-runner:latest
-    name: docker.io/aquasec/trivy:latest
-    entrypoint: [""]
-  variables:
-    # No need to clone the repo, we exclusively work on artifacts.  See
-    # https://docs.gitlab.com/ee/ci/runners/README.html#git-strategy
-    GIT_STRATEGY: none
-    TRIVY_USERNAME: ""
-    TRIVY_PASSWORD: ""
-    TRIVY_AUTH_URL: ""
-    FULL_IMAGE_NAME: $IMAGE_TAG
   stage: scan
   script:
-    - trivy --version
+    - apt -y update
-    # cache cleanup is needed when scanning images with the same tags, it does not remove the database
+    - apt -y install wget apt-transport-https gnupg lsb-release
-    - time trivy image --clear-cache
+    - wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | apt-key add -
-    - trivy image --clear-cache $IMAGE_TAG
+    - echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" >> /etc/apt/sources.list.d/trivy.list
+    - apt -y update
+    - apt -y install trivy
+    - trivy image --input scan/hybridauth.tgz         
   only:
     - master