Skip to content

Commit 7c84e02

Browse files
authored
feat: perform env subst on image for the assess_image command (#54)
Support providing the environment variable as the value of the `image` parameter for the `assess_image` command. Useful for cases when image name is not known upfront.
1 parent cb4c97c commit 7c84e02

File tree

4 files changed

+6
-2
lines changed

4 files changed

+6
-2
lines changed

.circleci/test-deploy.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ jobs:
7575
exit 1
7676
fi
7777
- security/assess_image:
78-
image: docker.io/security-sample:v1
78+
image: ${IMAGE_TO_USE}
7979
severity: critical
8080
report_path: /tmp/sample-vuln-report.json
8181
- run:

src/commands/assess_image.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ parameters:
1515
The Docker image to scan. Support following schemes
1616
(1) 'repo-name/image-name:tag' (2) '/path/to/image.tar'. Bases on provided scheme
1717
it will either use local Docker daemon or tarball archive from disk as a source.
18+
Performs environment variable substitution before using the value of this parameter.
1819
scanners:
1920
type: string
2021
default: vuln secret

src/examples/image_scan.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,12 @@ usage:
1414
vuln-and-secrets:
1515
machine:
1616
image: ubuntu-2204:current
17+
environment:
18+
TARGET_IMAGE: studiondev/node-security:lts
1719
steps:
1820
- checkout
1921
- security/assess_image:
20-
image: studiondev/node-security:lts
22+
image: ${TARGET_IMAGE}
2123
severity: medium
2224
ignore-fix-status: not-fixed,wont-fix
2325
exclude: /usr /var/**/*.log

src/scripts/assess-image.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ if [[ -z "${PARAM_STR_IMAGE}" ]]; then
66
exit 1
77
fi
88

9+
PARAM_STR_IMAGE=$(circleci env subst "${PARAM_STR_IMAGE}")
910

1011
function scan_secrets () {
1112
local args=(image "--scanners=secret" "--image-config-scanners=secret")

0 commit comments

Comments
 (0)