Add twistlock scan

codefresh.yml

@@ -29,6 +29,46 @@ steps:
       test:
         image: '${{build_step}}'
         command: npm test
+
+  TwistlockScanImage:
+    type: composition
+    composition:
+      version: '2'
+      services:
+        targetimage:
+          image: ${{build_step}} # Must be the Docker build step name
+          command: sh -c "exit 0"
+          labels:
+            build.image.id: ${{CF_BUILD_ID}} # Provides a lookup for the composition
+    composition_candidates:
+      scan_service:
+        image: codefresh/docker-twistcli:latest # Recommend replacing with current Twistlock Console version
+        environment: # Add only the Environment Variables you need
+          - CODEFRESH_CLI_KEY=${{CODEFRESH_CLI_KEY}} # Required
+          - CONSOLE_HOSTNAME=${{CONSOLE_HOSTNAME}} # Required
+          - CONSOLE_PORT=${{CONSOLE_PORT}} # Required
+          - CONSOLE_USERNAME=${{CONSOLE_USERNAME}} # Required
+          - CONSOLE_PASSWORD=${{CONSOLE_PASSWORD}} # Required
+          - DETAILS=true
+        command: python /twistlock-cli.py "docker inspect $$(docker inspect $$(docker ps -aqf label=build.image.id=${{CF_BUILD_ID}}) -f {{.Config.Image}}) -f {{.Id}} | sed 's/sha256://g'"
+        depends_on:
+          - targetimage
+        volumes: # Volumes required to run DIND
+          - /var/run/docker.sock:/var/run/docker.sock
+          - /var/lib/docker:/var/lib/docker
+    add_flow_volume_to_composition: true
+    on_success: # Execute only once the step succeeded
+      metadata: # Declare the metadata attribute
+        set: # Specify the set operation
+          - ${{build_step.imageId}}: # Select any number of target images
+            - SECURITY_SCAN: true
+
+    on_fail: # Execute only once the step failed
+      metadata: # Declare the metadata attribute
+        set: # Specify the set operation
+          - ${{build_step.imageId}}: # Select any number of target images
+            - SECURITY_SCAN: false
+
   push_to_registry:
     title: Push To Registry
     type: push

fullpipeline.yml

@@ -11,7 +11,7 @@ steps:
     title: Running Unit Tests
     image: '${{BuildingDockerImage}}'
     working_directory: IMAGE_WORK_DIR
-    commands: 
+    commands:
       - bash unit_test.sh
     on_success:
       metadata:
@@ -22,7 +22,7 @@ steps:
       metadata:
         set:
           - '${{BuildingDockerImage.imageId}}':
-              - CF_QUALITY: false  
+              - CF_QUALITY: false
   RunningPerformanceTests:
     title: Running Performance Tests
     type: composition
@@ -41,14 +41,14 @@ steps:
         command: bash runtests
         environment:
           - CF_VOLUME_PATH=${{CF_VOLUME_PATH}}
-          - TOKEN=${{TOKEN}} 
+          - TOKEN=${{TOKEN}}
         volumes:
          - '${{CF_VOLUME_NAME}}:/codefresh/volume'
     add_flow_volume_to_composition: true
     when:
       condition:
         all:
-          testresults: '"${{FAIL}}" == "0"' 
+          testresults: '"${{FAIL}}" == "0"'
     on_success:
       metadata:
         set:
@@ -60,6 +60,45 @@ steps:
         set:
           - '${{BuildingDockerImage.imageId}}':
               - CF_QUALITY: false
+  TwistlockScanImage:
+    title: Running Twistlock Security Tests
+    type: composition
+    composition:
+      version: '2'
+      services:
+        targetimage:
+          image: ${{BuildingDockerImage}} # Must be the Docker build step name
+          command: sh -c "exit 0"
+          labels:
+            build.image.id: ${{CF_BUILD_ID}} # Provides a lookup for the composition
+    composition_candidates:
+      scan_service:
+        image: sctechdev/docker-twistcli:latest # Recommend replacing with current Twistlock Console version
+        environment: # Add only the Environment Variables you need
+          - CODEFRESH_CLI_KEY=${{CODEFRESH_CLI_KEY}} # Required
+          - CONSOLE_HOSTNAME=${{CONSOLE_HOSTNAME}} # Required
+          - CONSOLE_PORT=${{CONSOLE_PORT}} # Required
+          - CONSOLE_USERNAME=${{CONSOLE_USERNAME}} # Required
+          - CONSOLE_PASSWORD=${{CONSOLE_PASSWORD}} # Required
+          - DETAILS=true
+        command: python /twistlock-cli.py "docker inspect $$(docker inspect $$(docker ps -aqf label=build.image.id=${{CF_BUILD_ID}}) -f {{.Config.Image}}) -f {{.Id}} | sed 's/sha256://g'"
+        depends_on:
+          - targetimage
+        volumes: # Volumes required to run DIND
+          - /var/run/docker.sock:/var/run/docker.sock
+          - /var/lib/docker:/var/lib/docker
+    add_flow_volume_to_composition: true
+    on_success: # Execute only once the step succeeded
+      metadata: # Declare the metadata attribute
+        set: # Specify the set operation
+          - ${{BuildingDockerImage.imageId}}: # Select any number of target images
+            - SECURITY_SCAN: true
+
+    on_fail: # Execute only once the step failed
+      metadata: # Declare the metadata attribute
+        set: # Specify the set operation
+          - ${{BuildingDockerImage.imageId}}: # Select any number of target images
+            - SECURITY_SCAN: false
   add_jira_info:
     title: Parsing jira Commit
     image: r.cfcr.io/razielt77_github/containers101/annotator:master
@@ -96,7 +135,7 @@ steps:
     when:
       condition:
         all:
-          testresults: '"${{FAIL}}" == "1"'   
+          testresults: '"${{FAIL}}" == "1"'
   passfail:
     title: failed
     image: alpine
@@ -108,4 +147,4 @@ steps:
         set:
           - '${{BuildingDockerImage.imageId}}':
               - CF_QUALITY: false
-            
+