mirror of
https://github.com/grafana/grafana.git
synced 2025-02-15 01:53:33 -06:00
3064209cd5
* 33369: Add pipeline step with trivy scan for latest on grafana/grafana to drone config * 33369:Add docker image scan steps to .drone.star file * 33369: Add low/medium/unknwon scan into one pipeline step * 33369:Make starlark generate code only for the given edition * 33369:Adjust naming and add loop into vulnerability step * Update scripts/job.star Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>
53 lines
1.5 KiB
Plaintext
53 lines
1.5 KiB
Plaintext
def cronjobs(edition):
|
|
if edition != 'oss':
|
|
edition='grafana-enterprise'
|
|
else:
|
|
edition='grafana'
|
|
|
|
trigger = {
|
|
'event': 'cron',
|
|
'cron': 'nightly',
|
|
}
|
|
platform_conf = {
|
|
'os': 'linux',
|
|
'arch': 'amd64',
|
|
}
|
|
steps=[
|
|
scan_docker_image_unkown_low_medium_vulnerabilities_step(edition),
|
|
scan_docker_image_high_critical_vulnerabilities_step(edition),
|
|
]
|
|
return [
|
|
{
|
|
'kind': 'pipeline',
|
|
'type': 'docker',
|
|
'platform': platform_conf,
|
|
'name': 'scan-docker-images',
|
|
'trigger': trigger,
|
|
'services': [],
|
|
'steps': steps,
|
|
}
|
|
]
|
|
|
|
def scan_docker_image_unkown_low_medium_vulnerabilities_step(edition):
|
|
tags=['latest', 'main', 'latest-ubuntu', 'main-ubuntu']
|
|
commands=[]
|
|
for t in tags:
|
|
commands.append('trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/{}:{}'.format(edition,t))
|
|
return {
|
|
'name': 'scan-docker-images-unkown-low-medium-vulnerabilities',
|
|
'image': 'aquasec/trivy:0.18.3',
|
|
'commands': commands,
|
|
}
|
|
|
|
def scan_docker_image_high_critical_vulnerabilities_step(edition):
|
|
tags=['latest','main','latest-ubuntu','main-ubuntu']
|
|
commands=[]
|
|
for t in tags:
|
|
commands.append('trivy --exit-code 1 --severity HIGH,CRITICAL grafana/{}:{}'.format(edition,t))
|
|
|
|
return {
|
|
'name': 'scan-docker-images-high-critical-vulnerabilities',
|
|
'image': 'aquasec/trivy:0.18.3',
|
|
'commands': commands,
|
|
}
|