To use clair-cicd in a CircleCI pipeline the following step is typically authored
- run:
name: Run docker image vulnerability risk assessment
command: |
curl \
-s \
-L \
https://raw.githubusercontent.com/simonsdave/clair-cicd/master/bin/assess-image-risk.sh | \
bash -s -- --verbose --whitelist 'file://clair-cicd-whitelist-dev-env.json' "${DOCKER_TEMP_IMAGE}"
That's not too bad but an Orb would simplify the above and provide a layer of abstraction so the invocation could be changed and consumers of clair-cicd would not be affected.
See this for how to author an Orb.