Trivy

.drone-v1.yml

@@ -1,7 +1,8 @@
-# ---
+---
 kind: pipeline
 name: default
 type: kubernetes
+
 platform:
   os: linux
   arch: amd64
@@ -11,22 +12,29 @@ steps:
   pull: if-not-exists
   image: plugins/docker
   settings:
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+    repo: quay.io/ukhomeofficedigital/dq-postgres-alpine
+    registry: quay.io
     dockerfile: Dockerfile
     force_tag: true
-    registry: quay.io
-    repo: quay.io/ukhomeofficedigital/dq-postgres-alpine
     tags:
-    - ${DRONE_COMMIT_SHA}
-    - ${DRONE_BUILD_NUMBER}
-  environment:
-    DOCKER_PASSWORD:
-      from_secret: docker_password
-    DOCKER_USERNAME:
-      from_secret: docker_username
+      - ${DRONE_COMMIT_SHA}
+      - ${DRONE_BUILD_NUMBER}
+    when:
+      event:
+      - push
+
+- name: trivy_scan
+  pull: if-not-exists
+  image: quay.io/ukhomeofficedigital/trivyscanner:b82
+  commands:
+  - trivy --ignore-unfixed --exit-code 1 --no-progress quay.io/ukhomeofficedigital/dq-postgres-alpine:${DRONE_COMMIT_SHA}
   when:
+    branch:
+      exclude:
+      - master
     event:
     - push
-
-services:
-  - name: docker
-    image: 340268328991.dkr.ecr.eu-west-2.amazonaws.com/acp/dind