This repo is the source of the Govulners CircleCI Orb, which uses Govulners to scan vulnerabilities in container images. This orb has one command, it scans a given image from a registry, like docker.io.

To use this orb in your repo add the following to the list of jobs in your .circleci/config.yml (assuming you already configured circleCI in your repo, if not please check Getting Started with CircleCI):

orbs:
  govulners: nextlinux/govulners@<version>


workflows:
  integration-test_deploy:
    jobs:
      - govulners/list-image-vulns:
          image-name: ubuntu:20.04 # govulners will pull this image from docker.io, by default, check the scan-image command for more options 
      - govulners/list-dir-vulns:
          path-to-scan: ./

Check Scan Image command for more options, such as: fail testing if an image has a vulnerability as severe or equal to high.

List vulnerabilities for a given container image.

List vulnerabilities for a local directory path.

Scan a Docker image with govulners.

Scan a given path with govulners.

All orbs are tested with .circleci/config.yaml of this repo. Finished orbs will be published to the public CircleCi orb repository under the nextlinux namespace.

• Orb testing will be initiated upon pushing to repo
• If orb passes linting & packing it will be published using @dev:alpha

After the @dev:alpha orb is successfully published, integration tests will be triggered. Once all tests have passed, the dev orb can be promoted to production. To View the current version of the orb, use the following command:

circleci orb info nextlinux/govulners

Use Makefile for repetitive operations such as: building, validation and publishing to CircleCI.

1. Open a new Pull Request to the default branch. New releases are only published on merges to the default branch. The included .circleci/config.yml configuration file automatically packs, tests, and publishes your orbs. By default, both integration tests and unit tests are enabled for this CI pipeline. It is highly recommended that you add integration tests at a minimum to ensure the functionality of your orb.

2. Ensure all tests pass. You can view the results of your tests directly on GitHub within the Pull Request, or, for a more detailed view, watch the entire pipeline on CircleCI.com.

3. Title Pull Request with Special Semver Tag. The included CI config uses the orb-tools orb to automatically publish orbs that pass testing on the default branch, provided that the commit message contains the correct tag designated the intended semver release. The tag template looks like this: [semver:], where is replaced with one of the following values:

CircleCI Orb Registry Page - The official registry page of this orb for all versions, executors, commands, and jobs described. CircleCI Orb Docs - Docs for using and creating CircleCI Orbs.

We welcome issues to and pull requests against this repository!