# Read more about this feature here: https://docs.gitlab.com/ee/user/project/merge_requests/container_scanning.html

container_scanning:
  stage: test
  image: docker:stable
  variables:
    DOCKER_DRIVER: overlay2
    # Defining two new variables based on GitLab's CI/CD predefined variables
    # https://docs.gitlab.com/ee/ci/variables/#predefined-environment-variables
    CS_IMAGE_REPOSITORY: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG
    CS_IMAGE_TAG: $CI_COMMIT_SHA
    # Prior to this, you need to have the Container Registry running for your project and setup a build job
    # with at least the following steps:
    #
    # docker build -t $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG .
    # docker push $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
    #
    # Also, one can specify a CS_IMAGE variable to scan a custom or external image
    #
    # Docker registry credentials
    CS_REGISTRY_USERNAME: gitlab-ci-token
    CS_REGISTRY_PASSWORD: $CI_JOB_TOKEN
    CS_REGISTRY: $CI_REGISTRY
  allow_failure: true
  services:
    - docker:stable-dind
  script:
    - export CS_VERSION=${SP_VERSION:-$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')}
    - export CS_IMAGE=${CS_IMAGE:-${CS_IMAGE_REPOSITORY}:${CS_IMAGE_TAG}}
    - docker run -d --name db arminc/clair-db:latest
    - docker run -p 6060:6060 --link db:postgres -d --name clair --restart on-failure arminc/clair-local-scan:v2.0.6
    - |
      if [[ "${CS_SKIP_REGISTRY_LOGIN}" != 1 ]]; then
        echo "Logging in with user ${CS_REGISTRY_USERNAME}..."
        echo ${CS_REGISTRY_PASSWORD} | docker login --username ${CS_REGISTRY_USERNAME} --password-stdin ${CS_REGISTRY}
      fi
    - docker pull ${CS_IMAGE}
    - |
      docker run \
        -v /var/run/docker.sock:/var/run/docker.sock \
        -v "$PWD:/output" \
        -w /output \
        --link clair \
        registry.gitlab.com/gitlab-org/security-products/container-scanning:${CS_VERSION} \
        /analyze \
        ${CS_WHITELIST_FILE:+-w "${CS_WHITELIST_FILE}"} \
        ${CS_LOG_FILE:+-l "${CS_LOG_FILE}"} \
        ${CS_REPORT_FILE:+-r "${CS_REPORT_FILE}"} \
        ${CS_IMAGE} \
        || true # always succeed to upload the artifacts
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
  dependencies: []
  only:
    refs:
      - branches
    variables:
      - $GITLAB_FEATURES =~ /\bcontainer_scanning\b/
  except:
    variables:
      - $CONTAINER_SCANNING_DISABLED