scanCompiledArtifacts.yml

# Repo: FirelyTeam/azure-pipeline-templates
# File: scanCompiledArtifacts.yml
# Description: scan a directory of compiled code for vulnerabilities

parameters:
- name: 'directory'
  type: 'string'
  displayName: 'The directory to scan for vulnerabilities' 
- name: 'trivyIgnoreFile'
  type: 'string'
  default: ''
  displayName: 'The path to the trivy ignore file'
- name : trivyCacheAzureSubscription
  type: string
  default: ''
  displayName: 'Subscription used to retrieve Trivy cache. If left empty, no cache will be used.'
- name : trivyCacheStorageAccount
  type: string
  default: ''

steps:
  - checkout: self
  - template: ./scanWithRetryTask.yml
    parameters:
      dockerExtraArguments: "-v ${{ parameters.directory }}/Binaries:/src"
      trivyExtraArguments: "filesystem /src"
      trivyIgnoreFile: ${{ parameters.trivyIgnoreFile }}
      displayName: Scan compiled code with Trivy
      trivyCacheAzureSubscription: ${{ parameters.trivyCacheAzureSubscription }}
      trivyCacheStorageAccount: ${{ parameters.trivyCacheStorageAccount }}
      localTrivyCachePath: $(Agent.TempDirectory)/trivy-cache