fixed authentication to the repo for a trivy job (#57)

Author: leonid-lapshin-covergo

.gflows/libs/job_scan_image.lib.yml

@@ -2,7 +2,6 @@
 #@ load("@ytt:struct", "struct")
 #@ load("tagging.lib.yml", "tagging")
 #@ load("job_docker_publish_alicloud.lib.yml", "get_docker_publish_alicloud_job_ids")
-#@ load("steps.lib.yml", "steps")
 
 ---
 #@ def generate_scan_image_job(image_name, services, registry):
@@ -15,13 +14,15 @@
     - #@ alicloud_job_id
     #@ end
   steps:
-    - #@ steps.login_docker(registry)
     - name: Run Trivy vulnerability scanner
       uses: aquasecurity/trivy-action@master
       with:
         image-ref: #@ "{}/{}:{}".format(registry.url, image_name, "${{ needs.version.outputs.app_version }}")
         format: 'table'
         vuln-type: 'os,library'
         severity: 'CRITICAL,HIGH'
+      env:
+        TRIVY_USERNAME: #@ getattr(registry, "user", "${{ github.repository_owner }}")
+        TRIVY_PASSWORD: #@ getattr(registry, "password","${{ secrets.GITHUB_TOKEN }}")
 #@ end
 ---

github-sample/workflows/build-publish.yml

@@ -1245,19 +1245,16 @@ jobs:
     - docker-publish-alicloud-auth-service
     - docker-publish-alicloud-auth-predeployment
     steps:
-    - name: Login to AliCloud Container Registry
-      uses: docker/login-action@v2
-      with:
-        registry: registry-intl.cn-hongkong.aliyuncs.com
-        username: ${{ secrets.ALI_CONTAINER_REGISTRY_USER }}
-        password: ${{ secrets.ALI_CONTAINER_REGISTRY_PASSWORD }}
     - name: Run Trivy vulnerability scanner
       uses: aquasecurity/trivy-action@master
       with:
         image-ref: registry-intl.cn-hongkong.aliyuncs.com/covergo/auth:${{ needs.version.outputs.app_version }}
         format: table
         vuln-type: os,library
         severity: CRITICAL,HIGH
+      env:
+        TRIVY_USERNAME: ${{ secrets.ALI_CONTAINER_REGISTRY_USER }}
+        TRIVY_PASSWORD: ${{ secrets.ALI_CONTAINER_REGISTRY_PASSWORD }}
   scan-image-auth-predeployment:
     name: Trivy scan
     runs-on: ubuntu-latest
@@ -1267,19 +1264,16 @@ jobs:
     - docker-publish-alicloud-auth-service
     - docker-publish-alicloud-auth-predeployment
     steps:
-    - name: Login to AliCloud Container Registry
-      uses: docker/login-action@v2
-      with:
-        registry: registry-intl.cn-hongkong.aliyuncs.com
-        username: ${{ secrets.ALI_CONTAINER_REGISTRY_USER }}
-        password: ${{ secrets.ALI_CONTAINER_REGISTRY_PASSWORD }}
     - name: Run Trivy vulnerability scanner
       uses: aquasecurity/trivy-action@master
       with:
         image-ref: registry-intl.cn-hongkong.aliyuncs.com/covergo/auth-predeployment:${{ needs.version.outputs.app_version }}
         format: table
         vuln-type: os,library
         severity: CRITICAL,HIGH
+      env:
+        TRIVY_USERNAME: ${{ secrets.ALI_CONTAINER_REGISTRY_USER }}
+        TRIVY_PASSWORD: ${{ secrets.ALI_CONTAINER_REGISTRY_PASSWORD }}
   deploy-tenant-tahoe:
     if: ${{ needs.version.outputs.is_production == 'true' }}
     runs-on: self-hosted