Nixius
/
hastebin
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Disable trivy-image scan, clean up debug output
ci/woodpecker/push/woodpecker Pipeline was successful Details 

- Comment out trivy-image step (scanning stale images, needs investigation)
- Remove debug output from build-image and trivy-fs
This commit is contained in:
Colin 2026-01-23 20:55:35 -05:00
parent 0386e7b44c
commit 2907277b52
Signed by: colin
SSH Key Fingerprint: SHA256:nRPCQTeMFLdGytxRQmPVK9VXY3/ePKQ5lGRyJhT5DY8
1 changed files with 16 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
.woodpecker.yml
View File

@ -81,24 +81,8 @@ steps:
commands: commands:
- echo "nameserver 1.1.1.1" > /etc/resolv.conf - echo "nameserver 1.1.1.1" > /etc/resolv.conf
- echo "nameserver 1.0.0.1" >> /etc/resolv.conf - echo "nameserver 1.0.0.1" >> /etc/resolv.conf
- echo "=== DEBUG - Git commit ==="
- git rev-parse HEAD | cat
- echo "=== DEBUG - package-lock.json exists ==="
- ls -la package-lock.json
- echo "=== DEBUG - package-lock.json hash ==="
- sha256sum package-lock.json | cat
- echo "=== DEBUG - glob version in lockfile ==="
- grep -A3 '"node_modules/glob"' package-lock.json | head -5 || echo "glob not found"
- echo "=== DEBUG - mime version in lockfile ==="
- grep -A3 '"node_modules/mime"' package-lock.json | head -5 || echo "mime not found"
- echo "=== DEBUG - tar version in lockfile ==="
- grep -A3 '"node_modules/tar"' package-lock.json | head -5 || echo "tar not found"
- echo "=== DEBUG - Check for vulnerable versions ==="
- grep -E '10\.4\.5|6\.2\.1|7\.4\.3|1\.2\.7' package-lock.json || echo "No vulnerable versions found"
- echo "=== DEBUG - Trivy version ==="
- trivy --version | cat - trivy --version | cat
- echo "=== Running Trivy scan with debug ===" - trivy fs --scanners vuln,misconfig --severity HIGH,CRITICAL --exit-code 0 .
- trivy fs --debug --scanners vuln,misconfig --severity HIGH,CRITICAL --exit-code 0 .
- trivy fs --scanners vuln,misconfig --severity HIGH,CRITICAL --exit-code 0 Dockerfile - trivy fs --scanners vuln,misconfig --severity HIGH,CRITICAL --exit-code 0 Dockerfile
when: when:
branch: main branch: main
@ -123,9 +107,6 @@ steps:
commands: commands:
- echo "nameserver 1.1.1.1" > /etc/resolv.conf - echo "nameserver 1.1.1.1" > /etc/resolv.conf
- echo "nameserver 1.0.0.1" >> /etc/resolv.conf - echo "nameserver 1.0.0.1" >> /etc/resolv.conf
- echo "=== DEBUG - Verifying lockfile before build ==="
- grep -A3 '"node_modules/glob"' package-lock.json | head -5 || echo "glob not found"
- grep -E '10\.4\.5|6\.2\.1|7\.4\.3' package-lock.json || echo "No vulnerable versions in lockfile"
- HOSTNAME=$(docker info --format "{{.Name}}") - HOSTNAME=$(docker info --format "{{.Name}}")
- echo "Building on $HOSTNAME" - echo "Building on $HOSTNAME"
- echo "$${DOCKER_REGISTRY_PASSWORD}" | docker login -u "$${DOCKER_REGISTRY_USER}" --password-stdin - echo "$${DOCKER_REGISTRY_PASSWORD}" | docker login -u "$${DOCKER_REGISTRY_USER}" --password-stdin
@ -137,22 +118,21 @@ steps:
event: [push, cron] event: [push, cron]
# Scan Docker image with Trivy # Scan Docker image with Trivy
trivy-image: # TODO: Disabled - scanning stale images, needs investigation
name: trivy-image # trivy-image:
image: aquasec/trivy:latest # name: trivy-image
depends_on: [ "build-image" ] # image: aquasec/trivy:latest
volumes: # depends_on: [ "build-image" ]
- /var/run/docker.sock:/var/run/docker.sock # volumes:
commands: # - /var/run/docker.sock:/var/run/docker.sock
- echo "nameserver 1.1.1.1" > /etc/resolv.conf # commands:
- echo "nameserver 1.0.0.1" >> /etc/resolv.conf # - echo "nameserver 1.1.1.1" > /etc/resolv.conf
- echo "=== DEBUG - Inspecting image contents ===" # - echo "nameserver 1.0.0.1" >> /etc/resolv.conf
- trivy --version | cat # - trivy --version | cat
- echo "=== DEBUG - Running Trivy with full output ===" # - trivy image --timeout 10m --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 git.nixc.us/nixius/hastebin:latest
- trivy image --debug --timeout 10m --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 git.nixc.us/nixius/hastebin:latest # when:
when: # branch: main
branch: main # event: [push, cron]
event: [push, cron]
# Generate SBOM for Docker image # Generate SBOM for Docker image
sbom-image: sbom-image: