Security Scans: Add trivy scans to every docker image used for building/testing/publishing (#69911)

* Created images.star

* Fix typo

* Add cronjobs for build-images

scripts/drone/pipelines/aws_marketplace.star

@@ -5,18 +5,21 @@ This module contains steps and pipelines publishing to AWS Marketplace.
 load(
     "scripts/drone/steps/lib.star",
     "compile_build_cmd",
-    "publish_image",
 )
 load("scripts/drone/vault.star", "from_secret")
 load(
     "scripts/drone/utils/utils.star",
     "pipeline",
 )
+load(
+    "scripts/drone/utils/images.star",
+    "images",
+)
 
 def publish_aws_marketplace_step():
     return {
         "name": "publish-aws-marketplace",
-        "image": publish_image,
+        "image": images["publish_image"],
         "commands": ["./bin/build publish aws --image grafana/grafana-enterprise --repo grafana-labs/grafanaenterprise --product 422b46fb-bea6-4f27-8bcc-832117bd627e"],
         "depends_on": ["compile-build-cmd"],
         "environment": {

scripts/drone/pipelines/ci_images.star

@@ -2,10 +2,6 @@
 This module contains steps and pipelines relating to creating CI Docker images.
 """
 
-load(
-    "scripts/drone/steps/lib.star",
-    "wix_image",
-)
 load(
     "scripts/drone/utils/utils.star",
     "pipeline",
@@ -14,6 +10,10 @@ load(
     "scripts/drone/vault.star",
     "from_secret",
 )
+load(
+    "scripts/drone/utils/images.star",
+    "images",
+)
 
 def publish_ci_windows_test_image_pipeline():
     trigger = {
@@ -28,7 +28,7 @@ def publish_ci_windows_test_image_pipeline():
         steps = [
             {
                 "name": "clone",
-                "image": wix_image,
+                "image": images["wix_image"],
                 "environment": {
                     "GITHUB_TOKEN": from_secret("github_token"),
                 },
@@ -39,7 +39,7 @@ def publish_ci_windows_test_image_pipeline():
             },
             {
                 "name": "build-and-publish",
-                "image": "docker:windowsservercore-1809",
+                "image": images["windows_server_core_image"],
                 "environment": {
                     "DOCKER_USERNAME": from_secret("docker_username"),
                     "DOCKER_PASSWORD": from_secret("docker_password"),

scripts/drone/pipelines/docs.star

@@ -5,11 +5,14 @@ This module returns all the pipelines used in the event of documentation changes
 load(
     "scripts/drone/steps/lib.star",
     "build_docs_website_step",
-    "build_image",
     "codespell_step",
     "identify_runner_step",
     "yarn_install_step",
 )
+load(
+    "scripts/drone/utils/images.star",
+    "images",
+)
 load(
     "scripts/drone/utils/utils.star",
     "pipeline",
@@ -46,7 +49,7 @@ def docs_pipelines(ver_mode, trigger):
 def lint_docs():
     return {
         "name": "lint-docs",
-        "image": build_image,
+        "image": images["build_image"],
         "depends_on": [
             "yarn-install",
         ],

scripts/drone/pipelines/github.star

@@ -6,18 +6,21 @@ load(
     "scripts/drone/steps/lib.star",
     "compile_build_cmd",
     "fetch_images_step",
-    "publish_image",
 )
 load("scripts/drone/vault.star", "from_secret")
 load(
     "scripts/drone/utils/utils.star",
     "pipeline",
 )
+load(
+    "scripts/drone/utils/images.star",
+    "images",
+)
 
 def publish_github_step():
     return {
         "name": "publish-github",
-        "image": publish_image,
+        "image": images["publish_image"],
         "commands": ["./bin/build publish github --repo $${GH_REGISTRY} --create"],
         "depends_on": ["fetch-images-enterprise2"],
         "environment": {

scripts/drone/pipelines/shellcheck.star

@@ -2,11 +2,15 @@
 This module returns a Drone step and pipeline for linting with shellcheck.
 """
 
-load("scripts/drone/steps/lib.star", "build_image", "compile_build_cmd")
+load("scripts/drone/steps/lib.star", "compile_build_cmd")
 load(
     "scripts/drone/utils/utils.star",
     "pipeline",
 )
+load(
+    "scripts/drone/utils/images.star",
+    "images",
+)
 
 trigger = {
     "event": [
@@ -25,7 +29,7 @@ trigger = {
 def shellcheck_step():
     return {
         "name": "shellcheck",
-        "image": build_image,
+        "image": images["build_image"],
         "depends_on": [
             "compile-build-cmd",
         ],

scripts/drone/pipelines/windows.star

@@ -10,11 +10,14 @@ load(
     "scripts/drone/steps/lib.star",
     "get_windows_steps",
     "windows_clone_step",
-    "windows_go_image",
     "windows_init_enterprise_steps",
     "windows_test_backend_step",
     "windows_wire_install_step",
 )
+load(
+    "scripts/drone/utils/images.star",
+    "images",
+)
 
 def windows_test_backend(trigger, edition, ver_mode):
     """ Generates a pipeline that runs backend tests on Windows
@@ -36,7 +39,7 @@ def windows_test_backend(trigger, edition, ver_mode):
     else:
         steps.extend([{
             "name": "windows-init",
-            "image": windows_go_image,
+            "image": images["windows_go_image"],
             "depends_on": ["clone"],
             "commands": [],
         }])