How can I run beta gcloud component like "gcloud beta artifacts docker images scan" within Cloud Build?

Question

I am trying to include the Container Analyis API link in a Cloud Build pipeline.This is a beta component and with command line I need to install it first:

gcloud components install beta local-extract

then I can run the on demand container analyis (if the container is present locally):

gcloud beta artifacts docker images scan ubuntu:latest

My question is how I can use component like beta local-extract within Cloud Build ?

I tried to do a fist step and install the missing componentL

## Update components
- name: 'gcr.io/cloud-builders/gcloud'
  args: ['components', 'install', 'beta', 'local-extract', '-q']
  id: Update component

but as soon as I move to the next step the update is gone (since it is not in the container)

I also tried to install the component and then run the scan using (& or ;) but it is failling:

## Run vulnerability scan
- name: 'gcr.io/cloud-builders/gcloud'
  args: ['components', 'install', 'beta', 'local-extract', '-q', ';', 'gcloud', 'beta', 'artifacts', 'docker', 'images', 'scan', 'ubuntu:latest', '--location=europe']

  id: Run vulnaribility scan

and I get:

Already have image (with digest): gcr.io/cloud-builders/gcloud
ERROR: (gcloud.components.install) unrecognized arguments:
  ;
  gcloud
  beta
  artifacts
  docker
  images
  scan
  ubuntu:latest
  --location=europe (did you mean '--project'?)
  To search the help text of gcloud commands, run:
  gcloud help -- SEARCH_TERMS

so my question are:

1. how can I run "gcloud beta artifacts docker images scan ubuntu:latest" within Cloud Build ?
2. bonus: from the previous command how can I get the "scan" output value that I will need to pass as a parameter to my next step ? (I guess it should be something with --format)

Answer 1

You should try the cloud-sdk docker image:

https://github.com/GoogleCloudPlatform/cloud-sdk-docker

The Cloud Build team (implicitly?) recommends it:

https://github.com/GoogleCloudPlatform/cloud-builders/tree/master/gcloud

With the cloud-sdk-docker container you can change the entrypoint to bash pipe gcloud commands together. Here is an (ugly) example:

https://github.com/GoogleCloudPlatform/functions-framework-cpp/blob/d3a40821ff0c7716bfc5d2ca1037bcce4750f2d6/ci/build-examples.yaml#L419-L432

As to your bonus question. Yes, --format=value(the.name.of.the.field) is probably what you want. The trick is to know the name of the field. I usually start with --format=json on my development workstation to figure out the name.