Mirrors/kasm-workspaces-core-images
1
0
Fork 0
mirror of https://github.com/kasmtech/workspaces-core-images.git synced 2026-07-18 00:45:59 +00:00
Code Issues Projects Releases Wiki Activity

QA-272 cache trivy in S3

Browse source 
This changes how the pipeline installs trivy. A scheduled job in the
qa-infrastructure project will download the latest release and store it
in S3. Jobs that use trivy retrieve it from there. This avoids rate
limiting and gives us more control over the version of trivy we use.
This commit is contained in:
Francis Ferrell 2026-01-09 09:54:16 -05:00
parent b40ddf9f98
commit ea3a4df0a0
No known key found for this signature in database
2 changed files with 11 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
ci-scripts/download-trivy
View file

@ -1,14 +1,18 @@
#!/bin/bash
set -euo pipefail
TRIVY_VERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
echo "$TRIVY_VERSION"
arch=$(arch | sed -e 's/aarch64/arm64/g' -e 's/x86_64/x86/g')
download_dir=$( mktemp -td )
curl -fsSLO --output-dir "$download_dir" "https://${S3_BUCKET}.s3.amazonaws.com/trivy/trivy-${arch}.tar.gz"
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
trivy_dir="${SCRIPT_DIR}/trivy"
rm -rf $trivy_dir
mkdir $trivy_dir
cd $trivy_dir
wget --no-verbose "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -O - | tar -zxvf -
tar -zxvf "${download_dir}/trivy-${arch}.tar.gz"
echo "Using trivy $( ./trivy --version )"
cp "${SCRIPT_DIR}/junit.tpl" "${SCRIPT_DIR}/trivy/contrib/"
if [[ -e "${SCRIPT_DIR}/junit.tpl" ]]; then
cp -v "${SCRIPT_DIR}/junit.tpl" "${SCRIPT_DIR}/trivy/contrib/"
fi

4
ci-scripts/gitlab-ci.template
View file

@ -185,7 +185,7 @@ scan_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
{% endfor %}{% endif %}
script:
- apk add bash
- apk add bash curl
- (cd ci-scripts && bash download-trivy)
- bash ci-scripts/scan image ${ORG_NAME}/image-cache-private:$(arch)-core-{{ IMAGE.name1 }}-{{ IMAGE.name2 }}-${SANITIZED_BRANCH}-${CI_PIPELINE_ID}
needs:
@ -224,7 +224,7 @@ scan_{{ IMAGE.name1 }}_{{ IMAGE.name2 }}:
{% endfor %}{% for FILE in IMAGE.changeFiles %}- {{ FILE }}
{% endfor %}{% endif %}
script:
- apk add bash
- apk add bash curl
- (cd ci-scripts && bash download-trivy)
- bash ci-scripts/scan image ${ORG_NAME}/image-cache-private:x86_64-core-{{ IMAGE.name1 }}-{{ IMAGE.name2 }}-${SANITIZED_BRANCH}-${CI_PIPELINE_ID}
needs: