sec-trivy-pipeline.yml

trigger: none

pool:
  vmImage: 'ubuntu-latest'

variables:
  pathToDockerFile: 'Dockerfile'
  ACRConnectionName: 'AzureContainerRegistry-DevSecOps'
  ACRLoginServer: 'adinermieacr.azurecr.io'
  ACRRepository: 'eshoponweb'

stages:
- stage: QualityCheckStage
  displayName: Quality Check Stage
  jobs:
    - job: TrivyJob
      displayName: Run AquaSec Trivy Scan
      steps:      
      - task: Docker@2
        displayName: Build Container
        inputs:
          containerRegistry: $(ACRConnectionName)
          repository: $(ACRRepository)
          command: build
          Dockerfile: $(pathToDockerFile)
          tags: |
            $(Build.BuildId)
      
      - bash: | 
          docker run -d -p 5000:8080 $(ACRLoginServer)/$(ACRRepository):$(Build.BuildId)
        displayName: 'Run App in Docker Container'
      
      - script: | 
          docker pull aquasec/trivy:latest
          docker run --rm --volume /var/run/docker.sock:/var/run/docker.sock \
            --volume $HOME/Library/Caches:/root/.cache/ --name Trivy aquasec/trivy:latest --format template --template "@contrib/junit.tpl" --output junit-report.xml \
             $(ACRLoginServer)/$(ACRRepository):$(Build.BuildId)
          docker cp $HOME/Library/Caches/junit-report.xml $(System.DefaultWorkingDirectory)/
          echo "Trivy DIR Content"
          cd $HOME/Library/Caches/trivy
          ls -la
          echo "Default Working DIR Content"
          cd $(System.DefaultWorkingDirectory)
          ls -la
        displayName: Run AquaSec Trivy

      - task: PublishTestResults@2
        displayName: Publish Test Results
        inputs:
          testResultsFormat: 'JUnit'
          testResultsFiles: '**/junit-report.xml'
          mergeTestResults: false
          failTaskOnFailedTests: true
          testRunTitle: 'AquaSec Trivy'