Project: Trivy (Provisioning / Security & Compliance)
File: gitlab-ci.md

GitLab 15.0 includes integration with Trivy. To , simply include the CI template in your `.gitlab-ci.yml` file: ```yaml include: template: Security/Container-Scanning.gitlab-ci.yml ``` If you're a GitLab 14.x Ultimate customer, you can use the same configuration above. Alternatively, you can always use the example configurations below. ```yaml stages: test trivy: stage: test image: docker:stable services: name: docker:dind entrypoint: ["env", "-u", "DOCKER_HOST"] command: ["dockerd-entrypoint.sh"] variables: DOCKER_HOST: tcp://docker:2375/ DOCKER_DRIVER: overlay2 DOCKERTLSCERTDIR: "" IMAGE: trivy-ci-test:$CICOMMITSHA TRIVYNOPROGRESS: "true" TRIVYCACHEDIR: ".trivycache/" before_script: export TRIVYVERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tagname":' | sed -E 's/."v([^"]+)"./\1/') echo $TRIVY_VERSION wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVYVERSION}/trivy${TRIVYVERSION}Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure: true script: docker build -t $IMAGE . ./trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl" -o gl-container-scanning-report.json $IMAGE ./trivy image --exit-code 0 --severity HIGH $IMAGE ./trivy image --exit-code 1 --severity CRITICAL $IMAGE cache: paths: .trivycache/ artifacts: reports: container_scanning: gl-container-scanning-report.json ``` To scan a previously built image that has already been pushed into the GitLab container registry the following CI job manifest can be used. Note that `entrypoint` needs to be unset for the `script` section to work. In case of a non-public GitLab project Trivy additionally needs to authenticate to the registry to be able to pull your application image. Finally, it is not necessary to clone the project repo as we only work with the container image. ```yaml container_scanning: image: name: docker.io/aquasec/trivy:latest entrypoint: [""] variables: GIT_STRATEGY: none TRIVYUSERNAME: "$CIREGISTRY_USER" TRIVYPASSWORD: "$CIREGISTRY_PASSWORD" TRIVYAUTHURL: "$CI_REGISTRY" TRIVYNOPROGRESS: "true" TRIVYCACHEDIR: ".trivycache/" FULLIMAGENAME: $CIREGISTRYIMAGE:$CICOMMITREF_SLUG script: trivy --version time trivy image --clear-cache time trivy image --download-db-only time trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl" --output "$CIPROJECTDIR/gl-container-scanning-report.json" "$FULLIMAGENAME" time trivy image --exit-code 0 "$FULLIMAGENAME" time trivy image --exit-code 1 --severity CRITICAL "$FULLIMAGENAME" cache: paths: .trivycache/ artifacts: when: always reports: container_scanning: gl-container-scanning-report.json tags: docker-runner ``` Depending on the edition of gitlab you have or your desired workflow, the container scanning template may not meet your needs. As an addition to the above container scanning template, a template for has been included. The key things to update from the above examples are the `template` and `report` type. An updated example is below. ```yaml stages: test trivy: stage: test image: docker:stable services: name: docker:dind entrypoint: ["env", "-u", "DOCKER_HOST"] command: ["dockerd-entrypoint.sh"] variables: DOCKER_HOST: tcp://docker:2375/ DOCKER_DRIVER: overlay2 DOCKERTLSCERTDIR: "" IMAGE: trivy-ci-test:$CICOMMITSHA TRIVYNOPROGRESS: "true" TRIVYCACHEDIR: ".trivycache/" before_script: export TRIVYVERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tagname":' | sed -E 's/."v([^"]+)"./\1/') echo $TRIVY_VERSION wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVYVERSION}/trivy${TRIVYVERSION}Linux-64bit.tar.gz -O - | tar -zxvf - allow_failure: true script: docker build -t $IMAGE . ./trivy image --exit-code 0 --format template --template "@/contrib/gitlab-codequality.tpl" -o gl-codeclimate-image.json $IMAGE ./trivy filesystem --scanners misconfig,vuln --exit-code 0 --format template --template "@/contrib/gitlab-codequality.tpl" -o gl-codeclimate-fs.json . apk update && apk add jq jq -s 'add' gl-codeclimate-image.json gl-codeclimate-fs.json > gl-codeclimate.json cache: paths: .trivycache/ artifacts: paths: gl-codeclimate.json reports: codequality: gl-codeclimate.json ``` Currently gitlab only supports a single code quality report. There is an open to support multiple reports. Until this has been implemented, if you already have a code quality report in your pipeline, you can use `jq` to combine reports. Depending on how you name your artifacts, it may be necessary to rename the artifact if you want to reuse the name. To then combine the previous artifact with the output of trivy, the following `jq` command can be used, `jq -s 'add' prev-codeclimate.json trivy-codeclimate.json > gl-codeclimate.json`. You'll be able to see a full report in the GitLab pipeline code quality UI, where filesystem vulnerabilities and misconfigurations include links to the flagged files and image vulnerabilities report the image/os or runtime/library that the vulnerability originates from instead.