Drone: Sync with main (#35015)

* Drone: Sync with main Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
2021-06-01 09:45:39 +02:00
parent 0727a3a66b
commit 1c87edb7cf
4 changed files with 114 additions and 3 deletions
@@ -0,0 +1,69 @@
+load('scripts/vault.star', 'from_secret')
+
+def cronjobs(edition):
+    if edition != 'oss':
+        edition='grafana-enterprise'
+    else:
+        edition='grafana'
+
+    trigger = {
+        'event': 'cron',
+        'cron': 'nightly',
+    }
+    platform_conf = {
+        'os': 'linux',
+        'arch': 'amd64',
+    }
+    steps=[ 
+        scan_docker_image_unkown_low_medium_vulnerabilities_step(edition),
+        scan_docker_image_high_critical_vulnerabilities_step(edition),
+        slack_job_failed_step('grafana-backend'),
+    ]
+    return [
+        {
+            'kind': 'pipeline',
+            'type': 'docker',
+            'platform': platform_conf,
+            'name': 'scan-docker-images',
+            'trigger': trigger,
+            'services': [],
+            'steps': steps,
+        }
+    ]
+
+def scan_docker_image_unkown_low_medium_vulnerabilities_step(edition):
+    tags=['latest', 'main', 'latest-ubuntu', 'main-ubuntu']
+    commands=[]
+    for t in tags:
+        commands.append('trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/{}:{}'.format(edition,t))
+    return {
+        'name': 'scan-docker-images-unkown-low-medium-vulnerabilities',
+        'image': 'aquasec/trivy:0.18.3',
+        'commands': commands,
+    }
+
+def scan_docker_image_high_critical_vulnerabilities_step(edition):
+    tags=['latest', 'main', 'latest-ubuntu', 'main-ubuntu']
+    commands=[]
+    for t in tags:
+        commands.append('trivy --exit-code 1 --severity HIGH,CRITICAL grafana/{}:{}'.format(edition,t))
+
+    return {
+        'name': 'scan-docker-images-high-critical-vulnerabilities',
+        'image': 'aquasec/trivy:0.18.3',
+        'commands': commands,
+    }
+
+def slack_job_failed_step(channel):
+    return {
+        'name': 'slack-notify-failure',
+        'image': 'plugins/slack',
+        'settings': {
+            'webhook': from_secret('slack_webhook'),
+            'channel': channel,
+            'template': 'Nightly docker image scan job for {{repo.name}} failed: {{build.link}}',
+        },
+        'when': {
+            'status': 'failure'
+        }
+    }
@@ -665,7 +665,6 @@ def build_docs_website_step():
        'name': 'build-docs-website',
        # Use latest revision here, since we want to catch if it breaks
        'image': 'grafana/docs-base:latest',
-        'failure': 'ignore',
        'depends_on': [
            'initialize',
            'build-frontend-docs',