> For the complete CircleCI developer hub index, see [llms.txt](https://circleci.com/developer/llms.txt)

# twistlock/twistcli-scan

This orb is a wrapper for the Twistlock twistcli scanning tool. To use this orb, you must have a licensed Twistlock installation and credentials for a user with the CI User role in the Twistlock Console. For detailed usage information, see https://github.com/add-twistlock/twistcli-scan-image-orb


## Commands

### install

Download the twistcli static binary from the Console

| Parameter | Type | Default | Description |
|---|---|---|---|
| `tl_user` | string |  | The Twistlock Console user with the CI User role |
| `tl_pass` | env_var_name |  | The Twistlock Console user's password |
| `tl_console_url` | string |  | The base URL for the console -- http://console.<my_company>.com:8083 -- without a trailing / |

### load

Load the image into the Executor machine from the tar file stashed in the Workspace

| Parameter | Type | Default | Description |
|---|---|---|---|
| `tl_image_tar` | string |  | The name of the image tar file stored in the workspace |
| `tl_workspace_name` | string |  | Name of workspace to docker save the image into so it can be scanned by orb |

### scan

Scan the container image with twistcli

| Parameter | Type | Default | Description |
|---|---|---|---|
| `tl_user` | string |  | The Twistlock Console user with the CI User role |
| `tl_pass` | env_var_name |  | The Twistlock Console user's password |
| `tl_console_url` | string |  | The base URL for the console -- http://console.<my_company>.com:8083 -- without a trailing / |
| `tl_image` | string |  | The name of the image to scan -- myimage or myorg/myimage or myorg/myimage:latest |
| `tl_vuln_thresh` | string |  | Sets the minimum vulnerability severity that returns a fail exit code. Supported values are low, medium, high, and critical |
| `tl_comp_thresh` | string |  | Sets the minimum compliance issue severity that returns a fail exit code. Supported values are low, medium, high, and critical |
| `tl_only_fixed` | boolean |  | Whether to only report vulnerabilities with fixes available |

## Jobs

### scan-image

| Parameter | Type | Default | Description |
|---|---|---|---|
| `tl_user` | string | $TL_USER | The Twistlock Console user with the CI User role |
| `tl_pass` | env_var_name | TL_PASS | The Twistlock Console user's password |
| `tl_console_url` | string | $TL_CONSOLE_URL | The base URL for the console -- http://console.<my_company>.com:8083 -- without a trailing / |
| `vuln-thresh` | string |  | Sets the minimum vulnerability severity that returns a fail exit code. Supported values are low, medium, high, and critical |
| `comp-thresh` | string |  | Sets the minimum compliance issue severity that returns a fail exit code. Supported values are low, medium, high, and critical |
| `only-fixed` | boolean | false | Whether to only report vulnerabilities with fixes available |
| `workspace-name` | string | workspace | Name of workspace to docker save the image-tar into so it can be scanned by orb |
| `image-tar` | string | image.tar | The name of the image tar file stored in the workspace -- defaults to image.tar |
| `image` | string |  | The name of the image to scan -- myimage or myorg/myimage or myorg/myimage:latest |

## Executors

### default

## Examples

### docker-build-save-load-scan

```yaml
version: 2.1
orbs:
  twistcli: twistlock/twistcli-scan@1.0.5
jobs:
  docker-build-and-save:
    executor: twistcli/default
    steps:
      - checkout
      - run: docker build -t myrepo/myimage:tag .
      - run: mkdir -p workspace
      - run: docker save myrepo/myimage:tag -o workspace/image.tar
      - persist_to_workspace:
          root: workspace
          paths:
            - image.tar
workflows:
  scan-image:
    jobs:
      - docker-build-and-save
      - twistcli/scan-image:
          requires:
            - docker-build-and-save
          context: tl_scan_context
          image: myrepo/myimage:tag
          image-tar: image.tar
          vuln-thresh: critical
          comp-thresh: ''
          only-fixed: true
```