From c5ccf31f2c7556cbedfdc44db478d88268d9eb26 Mon Sep 17 00:00:00 2001
From: Robert Kaussow <mail@thegeeklab.de>
Date: Sun, 27 Oct 2024 21:08:07 +0100
Subject: [PATCH] ci: add trivy and replace deprecated workflow syntax (#425)

---
 .woodpecker/build-container.yml | 29 +++++++++++++++++++----------
 .woodpecker/build-package.yml   | 10 +++++-----
 .woodpecker/docs.yml            | 21 +++++++++------------
 .woodpecker/lint.yml            |  2 ++
 .woodpecker/test.yml            |  2 +-
 5 files changed, 36 insertions(+), 28 deletions(-)

diff --git a/.woodpecker/build-container.yml b/.woodpecker/build-container.yml
index 56c208f..82dd379 100644
--- a/.woodpecker/build-container.yml
+++ b/.woodpecker/build-container.yml
@@ -12,22 +12,31 @@ steps:
       - pip install poetry poetry-dynamic-versioning -qq
       - poetry build
 
-  - name: dryrun
+  - name: security-build
     image: quay.io/thegeeklab/wp-docker-buildx:5
+    depends_on: [build]
     settings:
       containerfile: Containerfile.multiarch
-      dry_run: true
-      platforms:
-        - linux/amd64
-        - linux/arm64
-      provenance: false
+      output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
       repo: ${CI_REPO}
-    when:
-      - event: [pull_request]
+
+  - name: security-scan
+    image: docker.io/aquasec/trivy
+    depends_on: [security-build]
+    commands:
+      - trivy -v
+      - trivy image --input oci/${CI_REPO_NAME}
+    environment:
+      TRIVY_EXIT_CODE: "1"
+      TRIVY_IGNORE_UNFIXED: "true"
+      TRIVY_NO_PROGRESS: "true"
+      TRIVY_SEVERITY: HIGH,CRITICAL
+      TRIVY_TIMEOUT: 1m
+      TRIVY_DB_REPOSITORY: docker.io/aquasec/trivy-db:2
 
   - name: publish-dockerhub
     image: quay.io/thegeeklab/wp-docker-buildx:5
-    group: container
+    depends_on: [security-scan]
     settings:
       auto_tag: true
       containerfile: Containerfile.multiarch
@@ -48,7 +57,7 @@ steps:
 
   - name: publish-quay
     image: quay.io/thegeeklab/wp-docker-buildx:5
-    group: container
+    depends_on: security-scan
     settings:
       auto_tag: true
       containerfile: Containerfile.multiarch
diff --git a/.woodpecker/build-package.yml b/.woodpecker/build-package.yml
index 4b75817..fe8603f 100644
--- a/.woodpecker/build-package.yml
+++ b/.woodpecker/build-package.yml
@@ -40,11 +40,11 @@ steps:
 
   - name: publish-pypi
     image: docker.io/library/python:3.12
-    secrets:
-      - source: pypi_password
-        target: POETRY_HTTP_BASIC_PYPI_PASSWORD
-      - source: pypi_username
-        target: POETRY_HTTP_BASIC_PYPI_USERNAME
+    environment:
+      POETRY_HTTP_BASIC_PYPI_PASSWORD:
+        from_secret: pypi_password
+      POETRY_HTTP_BASIC_PYPI_USERNAME:
+        from_secret: pypi_username
     commands:
       - pip install poetry poetry-dynamic-versioning -qq
       - poetry publish -n
diff --git a/.woodpecker/docs.yml b/.woodpecker/docs.yml
index 4d915dc..dff8601 100644
--- a/.woodpecker/docs.yml
+++ b/.woodpecker/docs.yml
@@ -8,13 +8,11 @@ when:
 steps:
   - name: markdownlint
     image: quay.io/thegeeklab/markdownlint-cli
-    group: test
     commands:
       - markdownlint 'README.md' 'CONTRIBUTING.md'
 
   - name: spellcheck
     image: quay.io/thegeeklab/alpine-tools
-    group: test
     commands:
       - spellchecker --files 'docs/**/*.md' 'README.md' 'CONTRIBUTING.md' -d .dictionary -p spell indefinite-article syntax-urls
     environment:
@@ -22,20 +20,19 @@ steps:
 
   - name: link-validation
     image: docker.io/lycheeverse/lychee
-    group: test
     commands:
       - lychee --no-progress --format detailed README.md
 
   - name: pushrm-dockerhub
     image: docker.io/chko/docker-pushrm:1
-    secrets:
-      - source: docker_password
-        target: DOCKER_PASS
-      - source: docker_username
-        target: DOCKER_USER
+    depends_on: [markdownlint, spellcheck, link-validation]
     environment:
+      DOCKER_PASS:
+        from_secret: docker_password
+      DOCKER_USER:
+        from_secret: docker_username
       PUSHRM_FILE: README.md
-      PUSHRM_SHORT: Automate cloning a single branch from a list of repositories
+      PUSHRM_SHORT: Create docker tags from a given version string
       PUSHRM_TARGET: ${CI_REPO}
     when:
       - event: [push, manual]
@@ -45,10 +42,10 @@ steps:
 
   - name: pushrm-quay
     image: docker.io/chko/docker-pushrm:1
-    secrets:
-      - source: quay_token
-        target: APIKEY__QUAY_IO
+    depends_on: [markdownlint, spellcheck, link-validation]
     environment:
+      APIKEY__QUAY_IO:
+        from_secret: quay_token
       PUSHRM_FILE: README.md
       PUSHRM_TARGET: quay.io/${CI_REPO}
     when:
diff --git a/.woodpecker/lint.yml b/.woodpecker/lint.yml
index 461d74b..bcf33fe 100644
--- a/.woodpecker/lint.yml
+++ b/.woodpecker/lint.yml
@@ -8,6 +8,7 @@ when:
 steps:
   - name: check-format
     image: docker.io/library/python:3.12
+    depends_on: []
     commands:
       - pip install poetry poetry-dynamic-versioning -qq
       - poetry install
@@ -17,6 +18,7 @@ steps:
 
   - name: check-coding
     image: docker.io/library/python:3.12
+    depends_on: []
     commands:
       - pip install poetry poetry-dynamic-versioning -qq
       - poetry install
diff --git a/.woodpecker/test.yml b/.woodpecker/test.yml
index 6d5bb96..f7d1847 100644
--- a/.woodpecker/test.yml
+++ b/.woodpecker/test.yml
@@ -7,7 +7,7 @@ when:
 
 variables:
   - &pytest_base
-    group: pytest
+    depends_on: []
     commands:
       - pip install poetry poetry-dynamic-versioning -qq
       - poetry install