Merge pull request #282 from cloud-gov/grype-config

update to make grype scan exceptions more granular

Author: dandersonsw

ci/container/base/base_vars.yml

@@ -12,3 +12,4 @@ static-analysis-args:
 src-branch: main
 tailoring-file: common-pipelines/container/tailor.xml
 daily-scan-time: "0 1 * * *"
+grype-path: common-pipelines/container/grype.yaml

ci/container/external/base_vars.yml

@@ -15,3 +15,4 @@ build-test-args:
 build-test-params: {}
 daily-scan-time: "0 4 * * *"
 src-trigger: false
+grype-path: common-pipelines/container/grype.yaml

ci/container/internal/base_vars.yml

@@ -21,3 +21,4 @@ src-branch: main
 src-trigger: false
 tailoring-file: common-pipelines/container/tailor.xml
 daily-scan-time: "0 2 * * *"
+grype-path: common-pipelines/container/grype.yaml

ci/container/pages/base_vars.yml

@@ -16,3 +16,4 @@ build-test-args:
   ]
 build-test-params: {}
 daily-scan-time: "0 3 * * *"
+grype-path: common-pipelines/container/grype.yaml

container/pipeline-base.yml

@@ -88,6 +88,9 @@ jobs:
 
           - task: scan-image
             file: common-pipelines/container/scan-image.yml
+            params:
+              IMAGENAME: ((image-repository))
+              GRYPEPATH: ((grype-path))
 
       - in_parallel:
           - task: cve-check
@@ -153,6 +156,9 @@ jobs:
 
           - task: scan-image
             file: common-pipelines/container/scan-image.yml
+            params:
+              IMAGENAME: ((image-repository))
+              GRYPEPATH: ((grype-path))
 
       - task: cve-check
         file: common-pipelines/container/cve-check.yml
@@ -213,6 +219,9 @@ jobs:
 
       - task: scan-image
         file: common-pipelines/container/scan-image.yml
+        params:
+          IMAGENAME: ((image-repository))
+          GRYPEPATH: ((grype-path))
 
       - in_parallel:
           - task: cve-check

container/pipeline-external.yml

@@ -80,6 +80,9 @@ jobs:
 
           - task: scan-image
             file: common-pipelines/container/scan-image.yml
+            params:
+              IMAGENAME: ((image-repository))
+              GRYPEPATH: ((grype-path))
 
       - task: cve-check
         file: common-pipelines/container/cve-check.yml
@@ -140,6 +143,9 @@ jobs:
 
       - task: scan-image
         file: common-pipelines/container/scan-image.yml
+        params:
+          IMAGENAME: ((image-repository))
+          GRYPEPATH: ((grype-path))
 
       - in_parallel:
           - task: cve-check

container/pipeline-internal.yml

@@ -114,6 +114,9 @@ jobs:
 
           - task: scan-image
             file: common-pipelines/container/scan-image.yml
+            params:
+              IMAGENAME: ((image-repository))
+              GRYPEPATH: ((grype-path))
 
       - in_parallel:
           - task: cve-check
@@ -198,6 +201,9 @@ jobs:
 
           - task: scan-image
             file: common-pipelines/container/scan-image.yml
+            params:
+              IMAGENAME: ((image-repository))
+              GRYPEPATH: ((grype-path))
 
       - task: cve-check
         file: common-pipelines/container/cve-check.yml
@@ -258,6 +264,9 @@ jobs:
 
       - task: scan-image
         file: common-pipelines/container/scan-image.yml
+        params:
+          IMAGENAME: ((image-repository))
+          GRYPEPATH: ((grype-path))
 
       - in_parallel:
           - task: cve-check

container/pipeline-pages.yml

@@ -59,6 +59,9 @@ jobs:
 
           - task: scan-image
             file: common-pipelines/container/scan-image.yml
+            params:
+              IMAGENAME: ((image-repository))
+              GRYPEPATH: ((grype-path))
 
       - in_parallel:
           - task: cve-check
@@ -137,6 +140,9 @@ jobs:
 
           - task: scan-image
             file: common-pipelines/container/scan-image.yml
+            params:
+              IMAGENAME: ((image-repository))
+              GRYPEPATH: ((grype-path))
 
       - task: cve-check
         file: common-pipelines/container/cve-check.yml
@@ -195,6 +201,9 @@ jobs:
 
       - task: scan-image
         file: common-pipelines/container/scan-image.yml
+        params:
+          IMAGENAME: ((image-repository))
+          GRYPEPATH: ((grype-path))
 
       - in_parallel:
           - task: cve-check

container/scan-image.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
-grype image/image.tar -c common-pipelines/container/grype.yaml --only-fixed -q -o json --file cves/output.json
-grype image/image.tar -c common-pipelines/container/grype.yaml --only-fixed -q -o table --file table.txt
+grype image/image.tar -c ${GRYPEPATH} --only-fixed -q -o json --file cves/output.json
+grype image/image.tar -c ${GRYPEPATH} --only-fixed -q -o table --file table.txt
 
 cat cves/output.json | jq '.matches | .[]? |  .vulnerability.severity' >> severity.txt