Integration into a CI process

The system supports integrating vulnerability scanning into a GitLab CI/CD pipeline and uploading scan results to the system. A special script handles this process.

Setting environment variables

To run the script, fill in the required variables in the variables block of the .gitlab-ci.yml file. The variables are listed below.

Variable	Description
IMAGE_TO_SCAN	Docker image to scan (format: yourimagename/latest)
REPORT_FILE	Name of the file for saving the report (default: trivy-report.json)
API_URL	API URL for sending results: http://your-tronasoc-url/api/v1/check/{check_id}/external
API_TOKEN	API token for authentication in TRON.ASOC (format: asoc-your_api_token_here)

Example of a CI/CD pipeline implementation with Trivy and Grype

The CI/CD pipeline consists of two stages:

1. scan—checks the image for vulnerabilities.
2. upload—uploads the scan results to TRON.ASOC.

The example script for Trivy appears below.

stages:
  - scan
  - upload

variables:
  IMAGE_TO_SCAN: "anaisurlichs/cns-website:0.0.6"  # Целевой Docker-образ
  REPORT_FILE: "trivy-report.json"                 # Файл отчета
  API_URL: "http://example.asoc.ximi.group/api/v1/check/{check_id}/external"
  API_TOKEN: "asoc-exampletoken"                  # Защищенный токен доступа

scan_image:
  stage: scan
  image: aquasec/trivy:latest  # Официальный образ Trivy
  script:
    - trivy image --format json --output ${REPORT_FILE} ${IMAGE_TO_SCAN}
    - echo "[INFO] Сканирование завершено. Отчет сохранен в ${REPORT_FILE}"
  artifacts:
    paths:
      - ${REPORT_FILE}
    when: always  # Сохранять артефакты даже при ошибках
    expire_in: 1 week  # Срок хранения артефактов

upload_report:
  stage: upload
  image: curlimages/curl:latest  # Образ с curl
  script:
    - echo "[INFO] Отправка отчета ${REPORT_FILE} на ${API_URL}"
    - >
      curl --fail --location "${API_URL}" \
        --header "x-api-token: ${API_TOKEN}" \
        --header "Content-Type: application/json" \
        --data-binary @"${REPORT_FILE}"
  dependencies:
    - scan_image  # Ожидание завершения сканирования

The example script for Grype appears below.

grype_scan:
  image: anchore/grype:latest
  stage: scan
  script:
    - echo "[INFO] Начато сканирование образа ${IMAGE_TO_SCAN}"
    - grype ${IMAGE_TO_SCAN} --output json --file ${REPORT_FILE}
    - test -f ${REPORT_FILE} && echo "[SUCCESS] Отчет сохранен в ${REPORT_FILE}"
  artifacts:
    paths:
      - ${REPORT_FILE}
    when: always

Pipeline configuration recommendations

Keep the following recommendations in mind when configuring the CI/CD pipeline:

• for existing reports, you can use only the upload stage;
• save all sensitive data (API_TOKEN) in protected GitLab variables;
• when creating a pipeline for other tools, such as Semgrep or KICS, change the following parameters:
  • the Docker image in image;
  • the scan command in script.