wuyang
34 lines
1.2 KiB
Bash
Executable File
34 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
project_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "${project_dir}"
|
|
|
|
./scripts/audit-web-image.sh
|
|
|
|
runtime_image="${RUNTIME_AUDIT_IMAGE:-k1412-agent-runtime:audit}"
|
|
gateway_image="${GATEWAY_AUDIT_IMAGE:-k1412-agent-gateway:audit}"
|
|
workspace_image="${WORKSPACE_AUDIT_IMAGE:-k1412-agent-workspace:audit}"
|
|
trivy_image="aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f"
|
|
trivy_cache="k1412-trivy-cache"
|
|
|
|
docker build --platform linux/amd64 -f docker/runtime.Dockerfile -t "${runtime_image}" .
|
|
docker build --platform linux/amd64 -f docker/gateway.Dockerfile -t "${gateway_image}" .
|
|
docker build --platform linux/amd64 -f docker/workspace.Dockerfile -t "${workspace_image}" .
|
|
|
|
for image in "${runtime_image}" "${gateway_image}" "${workspace_image}"; do
|
|
docker run --rm "${image}" python -m pip check
|
|
docker run --rm \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v "${trivy_cache}:/root/.cache" \
|
|
"${trivy_image}" \
|
|
image \
|
|
--quiet \
|
|
--scanners vuln \
|
|
--severity HIGH,CRITICAL \
|
|
--ignore-unfixed \
|
|
--exit-code 1 \
|
|
--format json \
|
|
"${image}" >/dev/null
|
|
done
|