Commit 6d00b752 authored by Andres Anaya Amariels's avatar Andres Anaya Amariels 🚀
Browse files

improving code grype

parent 159f38b4

capif/templates/ci_staging.gitlab-ci.yml

+35 −20
Original line number Diff line number Diff line
@@ -121,9 +121,14 @@ staging_cvs: 
  stage: staging_cvs

  script: 

   - |

    # Install grype

    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b ../

    

    # Print grype version

    echo "### grype version###"

    ../grype version

    

    # Create output directory if it doesn't exist

    DIRECTORY=./grype-outputs

    if [ ! -d "$DIRECTORY" ]; then

      mkdir $DIRECTORY
@@ -131,28 +136,38 @@ staging_cvs: 
    else

      echo "Directory already exists"

    fi

    

    # Save current directory

    export TMP_PWD=$PWD

    echo "TMP_PWD=$TMP_PWD"

    

    # Array of image names

    IMAGE_NAMES=("capif-client" "nginx" "register")

    

    # Loop over image names

    for IMAGE_NAME in "${IMAGE_NAMES[@]}"; do

      echo "---- variable ----"

    export IMAGE_NAME=capif-client

    echo "### build and push $IMAGE_NAME image###"

    cd services/$IMAGE_NAME/

    docker login --username $CI_REGISTRY_USER --password $CAPIF_DOCKER_REGISTRY $CI_REGISTRY

    docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/$IMAGE_NAME:$CI_COMMIT_REF_SLUG .

    cd $TMP_PWD

    echo "### Container Vulnerability Scanning###"

    ../grype $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/$IMAGE_NAME:$CI_COMMIT_REF_SLUG --scope all-layers > ./grype-outputs/grype_$IMAGE_NAME-$CI_COMMIT_REF_SLUG.txt

    echo "----------------------------------------------------"

    echo "---- variable ----"

    export IMAGE_NAME=nginx

      echo "### build and push $IMAGE_NAME image###"

      

      # Navigate to service directory

      cd services/$IMAGE_NAME/

      

      # Login to Docker registry

      docker login --username $CI_REGISTRY_USER --password $CAPIF_DOCKER_REGISTRY $CI_REGISTRY

      

      # Build Docker image

      docker build -t $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/$IMAGE_NAME:$CI_COMMIT_REF_SLUG .

      

      # Navigate back to original directory

      cd $TMP_PWD

      

      echo "### Container Vulnerability Scanning###"

      

      # Scan Docker image with grype and save output to file

      ../grype $CI_REGISTRY/ocf/capif/$CI_COMMIT_REF_SLUG/$IMAGE_NAME:$CI_COMMIT_REF_SLUG --scope all-layers > ./grype-outputs/grype_$IMAGE_NAME-$CI_COMMIT_REF_SLUG.txt

      

      echo "----------------------------------------------------"

    done

  artifacts:

    untracked: false

    paths: