#!/bin/sh
set -eu

EXIT_CODE="${1:-1}"

echo "=== TRIVY ==="
echo "Version: $(trivy version --format '{{.Version}}' 2>/dev/null || trivy version)"
echo "Cache: ${TRIVY_CACHE_DIR}"
echo "=== TRIVY FILESYSTEM SCAN ==="

trivy fs \
  --severity HIGH,CRITICAL \
  --format table \
  --scanners vuln,misconfig \
  --skip-dirs ".trivycache" \
  --skip-dirs "target" \
  --cache-dir "$TRIVY_CACHE_DIR" \
  --offline-scan \
  --exit-code "$EXIT_CODE" \
  --no-progress \
  .

#!/bin/sh
set -eu

IMAGE=${1:?Image archive required}
EXIT_CODE=${2:-1}
IGNOREFILE=${3:-}

if [ -n "$IGNOREFILE" ]; then
    trivy image \
        --input "$IMAGE" \
        --severity HIGH,CRITICAL \
        --exit-code "$EXIT_CODE" \
        --ignore-unfixed \
        --ignorefile "$IGNOREFILE" \
        --timeout 10m \
        --cache-dir "$TRIVY_CACHE_DIR" \
        --format table \
        --no-progress
else
    trivy image \
        --input "$IMAGE" \
        --severity HIGH,CRITICAL \
        --exit-code "$EXIT_CODE" \
        --ignore-unfixed \
        --timeout 10m \
        --cache-dir "$TRIVY_CACHE_DIR" \
        --format table \
        --no-progress
fi

#!/bin/sh
set -eu

IMAGE_NAME=${1:?Image name missing}
SOURCE_TAG=${2:?Source tag missing}
SHA_TAG=${3:?SHA tag missing}
RELEASE_TAG=${4:?Release tag missing}

TARGET_IMAGE="$CI_REGISTRY_IMAGE"

echo "====================================="
echo "Push Docker image to GitLab Registry"
echo "Target: ${TARGET_IMAGE}"
echo "====================================="

echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" \
  -u "$CI_REGISTRY_USER" \
  --password-stdin

docker tag "${IMAGE_NAME}:${SOURCE_TAG}" \
  "${TARGET_IMAGE}:sha-${SHA_TAG}"

docker tag "${IMAGE_NAME}:${SOURCE_TAG}" \
  "${TARGET_IMAGE}:${RELEASE_TAG}"

docker tag "${IMAGE_NAME}:${SOURCE_TAG}" \
  "${TARGET_IMAGE}:latest"

docker push "${TARGET_IMAGE}:sha-${SHA_TAG}"
docker push "${TARGET_IMAGE}:${RELEASE_TAG}"
docker push "${TARGET_IMAGE}:latest"

echo "Docker image successfully pushed to GitLab Registry"