To make the review of your request easier, please use the following template to provide all the required details and also include any other information that may be relevant.
- name: circleci
- description: command line interface to CircleCI
- snapcraft: URL pointing to the snapcraft.yaml if publicly available
- upstream:
https://github.com/circleci-public/circleci-cli
- upstream-relation: CircleCI maintains the CLI
- supported-category: public cloud agents
- reasoning: CircleCI is a cloud hosted CI/CD tool. Our CLI supports an extension mechanism which can run user defined binaries. We also support running arbitrary commands as part of the CLI. Finally we need to connect to the user’s password manager. For those reasons we found we need classic confinement.
I understand that strict confinement is generally preferred over classic.
I’ve tried the existing interfaces to make the snap to work under strict confinement.
Note that snappy-debug can be used to identify possible required interfaces. See https://snapcraft.io/docs/debug-snaps for more information.
Welcome! I’ll let the review team do their thing here on classic, but in the mean time if you’re representing CircleCI in a somewhat official capacity, it might be worth dropping a request for a Verified Publisher account to give the snap legitimacy in the store 
Verified Accounts
1 Like
This request has been added to the queue for review by the @reviewers team.
Ah thank you, I am in fact representing CircleCI! Verified request filed
Hey folks!
CircleCI is a cloud-hosted CI/CD tool. Our CLI supports an extension mechanism that can run user-defined binaries, and it also supports running arbitrary commands as part of the CLI.
Could you point us to any public documentation covering this use case? Could you also provide additional details about when this is expected to be used and for what purpose?
Finally, we need to connect to the user’s password manager.
This can be done using the password-manager-service interface and/or the XDG Secret Portal, depending on the use case.
Moreover, I do not think CircleCI clearly fits the “public cloud agents” category, or any other supported category as defined in the process for Reviewing classic confinement snaps - Snap documentation . Fitting into a supported category is a hard requirement that can only be overridden by an architect under special circumstances.
Thanks
I agree that we should try where possible to make this strictly confined, but my guess is that if this is a CI runner in the general sense, it would need classic to be useful.
Looking at the upstream, it seems like it’s not actually a runner, but a tool for managing existing CircleCI deployments, so perhaps we should focus more on the strict confinement route.
Hi, sorry for the delay responding.
This CLI is for interacting with circleci systems.
As for the plugin mechanism, it is documented here. We detect plugins with a standard prefix on the user’s PATH. So they can live outside a home directory. For example we distribute a plugin for running tests based on historical CI data. This is similar to the extension mechanism used by the GH CLI.
The plugin system is the technical motivation for requesting classic confinement.
Thanks,
Michael
Hey @webster-cci
As for the plugin mechanism, it is documented here.
I’m not sure I would define this as public documentation to be honest.
Anyway, according to the Reviewing classic confinement snaps - Snap documentation , I think this falls under the unsupported reason “dependent software only available on host”.
- For the official plugins created by your company, you can ship the plugins with your snap, or download them at runtime, perhaps in $SNAP_COMMON (if they are expected to be shared across users) or $SNAP_USER_COMMON (if they should only available to the specific user).
- For custom plugins created by users, they can be added to SNAP_USER_COMMON or something like
~/.circleci/bin. If users eventually start using these extension system in unforeseeable ways and this starts to cause some friction, we can reevaluate classic confinement based on that.
