wuyang
29 lines
983 B
Bash
Executable File
29 lines
983 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
project_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "${project_dir}"
|
|
|
|
image="${WEB_AUDIT_IMAGE:-k1412-agent-web:audit}"
|
|
trivy_image="aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f"
|
|
trivy_cache="k1412-trivy-cache"
|
|
docker build -f docker/web.Dockerfile -t "${image}" .
|
|
|
|
docker run --rm --entrypoint sh "${image}" -lc '
|
|
python -m pip check &&
|
|
python -m pip install -q pip-audit &&
|
|
python -m pip_audit
|
|
'
|
|
|
|
docker volume inspect "${trivy_cache}" >/dev/null 2>&1 \
|
|
|| docker volume create "${trivy_cache}" >/dev/null
|
|
trivy=(docker run --rm \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v "${trivy_cache}:/root/.cache" \
|
|
"${trivy_image}")
|
|
scan_args=(image --quiet --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1)
|
|
if ! "${trivy[@]}" "${scan_args[@]}" --format json "${image}" >/dev/null; then
|
|
"${trivy[@]}" "${scan_args[@]}" "${image}" || true
|
|
exit 1
|
|
fi
|