sysdiglabs / circleci-orb Goto Github PK

Actual behavior
When executing "test-inline-image-created" pipeline with CircleCI using our official Orb pointing to quay.io/sysdig/secure-inline-scan, the execution is aborted with the following error:

^@^@
ERROR:
Cannot access /var/run/docker.sock

Exited with code exit status 3
CircleCI received exit code 3

Link to a failed execution: https://app.circleci.com/pipelines/github/sysdiglabs/circleci-orb/93/workflows/2fa4b179-847f-4feb-b973-fe7b89503c51/jobs/256

Please note that we have resolved the problem temporary by rolling back the image to "quay.io/sysdig/secure-inline-scan:2.4.5" version.

Expected behavior
When executing test-inline-image-created, an image should be scanned and result published, with a green seal in the execution list.Link to a completed execution: https://app.circleci.com/pipelines/github/sysdiglabs/circleci-orb/101/workflows/7a1a1d4b-b471-4eb6-939c-8fa082664a21/jobs/280Steps to reproduce1. Create a test branch in 2. Edit src/commands/inline-image-scan.yml line 55 and change quay.io/sysdig/secure-inline-scan:2.4.5 to point to latest3. Commit your changes to remote test branch so that CircleCI test pipeline were triggered4. Go to our CircleCI dashboard and check how the pipeline “test-inline-image-created” fails

Hello,

My name is Kyle from the CircleCI CPE team. I have reviewed your orb and have a few suggestion items below.

• Never use "strings" for secret values. Instead expect the name of an environment variable.

  • circleci-orb/src/commands/inline-image-scan.yml

    Line 7 in 912798c

    sysdig-secure-token:

  • https://circleci.com/docs/2.0/orbs-best-practices/#secrets-should-never-be-directly-entered
• Update usage examples to reflect above change
• change advanced_example name to reflect what use-case this example showcases.

--

Looking at the orb I wonder too if this orb should have job(s), potentially even in-place of commands instead. In the use-cases shown it appears as though it would be common to supply a docker container (or image) and scan.

These self-contained actions seem like a perfect use-case for a job that a user could simply add to their existing workflows.
https://circleci.com/docs/2.0/orb-author-faq/#command-vs-job