Merge pull request #37 from WyriHaximus/use-trivy-for-cve-scanning

Use Trivy for CVE scanning

Author: WyriHaximus

.docker/security/docker-compose.yml

@@ -74,25 +74,15 @@ jobs:
       - uses: actions/checkout@v1
       - run: docker version
       - run: docker images
-      - name: Install clair-scanner
-        run: |
-          sudo curl -L https://github.com/arminc/clair-scanner/releases/download/v8/clair-scanner_linux_amd64 -o /usr/local/bin/clair-scanner
-          sudo chmod +x /usr/local/bin/clair-scanner
-      - run: docker images
-      - run: mkdir -p $(echo "./clair/${DOCKER_IMAGE}:${REF}" | tr '[:upper:]' '[:lower:]')
-        env:
-          REF: ${{ needs.generate-ref.outputs.ref }}
-      - run: docker-compose -f .docker/security/docker-compose.yml -p clair-ci up -d
       - run: docker build --no-cache -t "${DOCKER_IMAGE}:${REF}" . -f Dockerfile-build
         env:
           REF: ${{ needs.generate-ref.outputs.ref }}
       - run: docker tag "${DOCKER_IMAGE}:${REF}" "${DOCKER_IMAGE}:sha-${GITHUB_SHA}"
         env:
           REF: ${{ needs.generate-ref.outputs.ref }}
-      - run: echo -e "${DOCKER_IMAGE}:${REF}" | xargs -I % sh -c 'clair-scanner --ip 172.17.0.1 -r "./clair/%.json" -l ./clair/clair.log % || (echo "% is vulnerable" && exit 1)'
+      - run: docker run -v /tmp/trivy:/var/lib/trivy -v /var/run/docker.sock:/var/run/docker.sock -t aquasec/trivy:latest --cache-dir /var/lib/trivy image --exit-code 1 --no-progress --format table $(echo "${DOCKER_IMAGE}:${REF}" | tr '[:upper:]' '[:lower:]')
         env:
           REF: ${{ needs.generate-ref.outputs.ref }}
-      - run: docker-compose -f .docker/security/docker-compose.yml -p clair-ci down
       - run: docker images
       - name: Login to Docker Hub
         if: contains(github.ref, 'dependabot') == false