---
kind: pipeline
name: linux-amd64

platform:
  os: linux
  arch: amd64

steps:
- name: build
  pull: always
  image: rancher/hardened-build-base:v1.15.8b5
  commands:
  - make DRONE_TAG=${DRONE_TAG}
  volumes:
  - name: docker
    path: /var/run/docker.sock

- name: publish
  image: rancher/hardened-build-base:v1.15.8b5
  commands:
  - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
  - make DRONE_TAG=${DRONE_TAG} image-push image-manifest
  environment:
    DOCKER_PASSWORD:
      from_secret: docker_password
    DOCKER_USERNAME:
      from_secret: docker_username
  volumes:
  - name: docker
    path: /var/run/docker.sock
  when:
    event:
    - tag

- name: scan
  image: rancher/hardened-build-base:v1.15.8b5
  commands:
  - make DRONE_TAG=${DRONE_TAG} image-scan
  volumes:
  - name: docker
    path: /var/run/docker.sock

volumes:
- name: docker
  host:
    path: /var/run/docker.sock

...