Skip to content

Commit b08ab72

Browse files
davidjeddydavidjeddy
committed
Working on getting Trivy report into Security Tab
1 parent 7141e77 commit b08ab72

File tree

12 files changed

+200
-90
lines changed

12 files changed

+200
-90
lines changed

‎.github/workflows/build-and-push.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,11 @@ jobs:
3434

3535
- name: Build an image from Dockerfile
3636
run: |
37-
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{matrix.arch}} .
37+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.SHA }}-${{matrix.arch}} .
3838
3939
- name: Push an image
4040
run: |
41-
docker image push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{matrix.arch}}
41+
docker image push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.SHA }}-${{matrix.arch}}
4242
4343
manifest_build_and_push_on_feature:
4444
if: github.ref != 'refs/heads/main'
@@ -55,8 +55,8 @@ jobs:
5555
run: |
5656
docker manifest create \
5757
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.SHA }} \
58-
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:amd64 \
59-
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:arm64
58+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.SHA }}-amd64 \
59+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.SHA }}-arm64
6060
6161
- name: Push manifest
6262
run: |
@@ -78,8 +78,8 @@ jobs:
7878
run: |
7979
docker manifest create \
8080
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }} \
81-
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:amd64 \
82-
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:arm64
81+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.SHA }}-amd64 \
82+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.SHA }}-arm64
8383
8484
- name: Push manifest
8585
run: |

‎.github/workflows/dive.yml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,27 @@
11
name: Dive Test
22

3-
on: [pull_request]
3+
on: push
4+
5+
permissions:
6+
contents: read
7+
8+
env:
9+
IMAGE_NAME: appwrite/base
10+
REGISTRY: docker.io
411

512
jobs:
613
dive:
714
runs-on: ubuntu-latest
8-
name: Analyze image efficiency
915
steps:
1016
- name: Checkout code
1117
uses: actions/checkout@v6.0.2
1218

1319
- name: Build an image from Dockerfile
1420
run: |
15-
docker image build -t appwrite/docker-base:${{ github.sha }} .
21+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
1622
1723
- name: Dive
1824
uses: yuichielectric/dive-action@0.0.4
1925
with:
2026
github-token: ${{ secrets.GH_TOKEN }}
21-
image: appwrite/docker-base:${{ github.sha }}
27+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.SHA }}

‎.github/workflows/lifecycle-policy.yml‎

Lines changed: 30 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,36 @@
1-
# # https://github.com/marketplace/actions/delete-package-versions
2-
# # Ignore SemVer tags (proper releases)
3-
# # Keep 7 sha tagged images (ordred by publish datetime)
1+
# https://github.com/marketplace/actions/delete-package-versions
2+
# Ignore SemVer tags (proper releases)
3+
# Keep 7 sha tagged images (ordred by publish datetime)
44

5-
# name: Container Lifecycle Policy
5+
name: Container Lifecycle Policy
66

7-
# on:
8-
# schedule:
9-
# - cron: '30 9 * * *'
7+
on:
8+
schedule:
9+
- cron: '30 9 * * *'
1010

11-
# permissions:
12-
# contents: read
11+
permissions:
12+
contents: read
1313

14-
# env:
15-
# IMAGE_NAME: appwrite/base
16-
# REGISTRY: docker.io
14+
env:
15+
IMAGE_NAME: appwrite/base
16+
REGISTRY: docker.io
1717

18-
# jobs:
19-
# prune_sha_tagged_images:
20-
# runs-on: ubuntu-24.04
21-
# steps:
22-
# - name: Login to DockerHub
23-
# uses: docker/login-action@v4
24-
# with:
25-
# username: ${{ secrets.DOCKERHUB_USERNAME }}
26-
# password: ${{ secrets.DOCKERHUB_TOKEN }}
18+
jobs:
19+
prune_sha_tagged_images:
20+
runs-on: ubuntu-24.04
21+
steps:
22+
- name: Login to DockerHub
23+
uses: docker/login-action@v4
24+
with:
25+
username: ${{ secrets.DOCKERHUB_USERNAME }}
26+
password: ${{ secrets.DOCKERHUB_TOKEN }}
2727

28-
# # https://github.com/marketplace/actions/delete-package-versions#delete-oldest-x-number-of-versions-while-ignoring-particular-package-versions
29-
# # Ignore SemVer tagged images https://ihateregex.io/expr/semver/
30-
# - uses: actions/delete-package-versions@v5
31-
# with:
32-
# ignore-versions: '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
33-
# min-versions-to-keep: 7
34-
# package-name: 'base'
35-
# package-type: 'container'
28+
# TODO pull all the images in the registry before running this. Be sure we have a backup
29+
# # https://github.com/marketplace/actions/delete-package-versions#delete-oldest-x-number-of-versions-while-ignoring-particular-package-versions
30+
# # Ignore SemVer tagged images https://ihateregex.io/expr/semver/
31+
# - uses: actions/delete-package-versions@v5
32+
# with:
33+
# ignore-versions: '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
34+
# min-versions-to-keep: 7
35+
# package-name: 'base'
36+
# package-type: 'container'

‎.github/workflows/scheduled-trivy.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,34 +10,36 @@ on:
1010
- cron: '43 11 * * 6'
1111

1212
permissions:
13-
contents: read
13+
contents: read # for actions/checkout to fetch code
14+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
15+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
16+
17+
env:
18+
IMAGE_NAME: appwrite/base
19+
REGISTRY: docker.io
1420

1521
jobs:
1622
scheduled_trivy:
17-
permissions:
18-
contents: read # for actions/checkout to fetch code
19-
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
20-
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
21-
name: Build
2223
runs-on: ubuntu-24.04
2324
steps:
2425
- name: Checkout code
2526
uses: actions/checkout@v6.0.2
2627

2728
- name: Build an image from Dockerfile
2829
run: |
29-
docker image build -t appwrite/docker-base:${{ github.sha }} .
30+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
3031
3132
- name: Run Trivy vulnerability scanner
3233
uses: aquasecurity/trivy-action@0.35.0
3334
with:
3435
image-ref: 'appwrite/docker-base:${{ github.sha }}'
3536
format: 'template'
3637
template: '@/contrib/sarif.tpl'
37-
output: 'trivy-results.sarif'
38+
output: 'trivy-image-results.sarif'
3839
severity: 'CRITICAL,HIGH'
3940

41+
# https://github.com/github/codeql-action/blob/main/upload-sarif/action.yml
4042
- name: Upload Trivy scan results to GitHub Security tab
4143
uses: github/codeql-action/upload-sarif@v4.32.6
4244
with:
43-
sarif_file: 'trivy-results.sarif'
45+
sarif_file: 'trivy-image-results.sarif'

‎.github/workflows/structure-test.yml‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
1+
# https://github.com/marketplace/actions/container-structure-test-action
12
name: Container Structure Test
23

3-
on: [pull_request]
4+
on: push
5+
6+
permissions:
7+
contents: read
48

59
env:
610
REGISTRY: docker.io
711
IMAGE_NAME: appwrite/base
8-
TAG: ${{ github.event.release.tag_name }}
912

1013
jobs:
1114
structure_test:
@@ -14,13 +17,12 @@ jobs:
1417
- name: Checkout the repo
1518
uses: actions/checkout@v6.0.2
1619

17-
- name: Setup container-structure-test
20+
- name: Build an image from Dockerfile
1821
run: |
19-
curl -LO https://storage.googleapis.com/container-structure-test/latest/container-structure-test-linux-amd64
20-
chmod +x container-structure-test-linux-amd64
21-
sudo mv container-structure-test-linux-amd64 /usr/local/bin/container-structure-test
22+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
2223
23-
- name: Run container structure test
24-
run: |
25-
docker build -t appwrite-base-test .
26-
container-structure-test test --image appwrite-base-test --config tests.yaml
24+
- name: Run container structure tests
25+
uses: plexsystems/container-structure-test-action@v0.1.0
26+
with:
27+
image: m${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
28+
config: tests.yaml

‎.github/workflows/trivy.yml‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,38 @@
1+
# https://github.com/aquasecurity/trivy-action
12
name: Push Trivy Scan
23

34
on: push
45

56
permissions:
6-
contents: read
7+
contents: read # for actions/checkout to fetch code
8+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
9+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
10+
11+
env:
12+
IMAGE_NAME: appwrite/base
13+
REGISTRY: docker.io
714

815
jobs:
916
trivy:
10-
permissions:
11-
contents: read # for actions/checkout to fetch code
12-
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
13-
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
14-
name: Build
1517
runs-on: ubuntu-24.04
1618
steps:
1719
- name: Checkout code
1820
uses: actions/checkout@v6.0.2
1921

2022
- name: Build an image from Dockerfile
2123
run: |
22-
docker image build -t appwrite/docker-base:${{ github.sha }} .
24+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
2325
24-
- name: Run Trivy vulnerability scanner
26+
- name: Run Trivy vulnerability scanner (sarif report)
2527
uses: aquasecurity/trivy-action@0.35.0
2628
with:
27-
image-ref: 'appwrite/docker-base:${{ github.sha }}'
28-
format: 'template'
29-
template: '@/contrib/sarif.tpl'
30-
output: 'trivy-results.sarif'
29+
format: 'sarif'
30+
image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
31+
output: 'trivy-image-results.sarif'
3132
severity: 'CRITICAL,HIGH'
3233

33-
- name: Upload Trivy scan results to GitHub Security tab
34-
uses: github/codeql-action/upload-sarif@v4.32.6
34+
# https://github.com/github/codeql-action/blob/main/upload-sarif/action.yml
35+
- name: Upload Trivy scan results
36+
uses: github/codeql-action/upload-sarif@v4
3537
with:
36-
sarif_file: 'trivy-results.sarif'
38+
sarif_file: '.'

‎CHANGES.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,20 +12,20 @@
1212
* container-structure-test to check PHP version (currently set to 8.5.3)
1313
* container-structure-test to check swoole version (currently set to 6.2.0)
1414
* SECURITY.md to align with appwrite/appwrite
15-
*
1615

1716
### Change
1817

1918
* .github/*.yml steps updated to latest versions
2019
* .gitignore now includes log and scanning output rules
21-
* Better document use of `docker-buildx build ...` for local builds
20+
* Better document use of `docker buildx ...` for local builds
2221
* Better noted and organized the different build processes for PHP extensions
2322
* Date component of PHP extension shared objects directory now a build argument
2423
* Dockerfile compile and final stage system packages aligned
24+
* Github action for container-structure-test now uses a marketplace action
2525
* Github action runners pinned to Ubuntu 24.04
2626
* ImageMagick version bumped to 7.1.2.15, tests.yaml aligned to ensure new version
2727
* PHP version bumped to 8.5.3
28-
* Refactory multi-arch build process to prevent cross-arch builds requiring long wait times
28+
* Refactored multi-arch build process to prevent cross-arch builds requiring long wait times
2929
* Swoole version bumped to 6.2.0
3030

3131
### Fixes

‎Dockerfile‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
ARG BASE_IMAGE="php:8.5.3-cli-alpine3.23"
1+
ARG BASE_IMAGE="phpswoole/swoole:php8.5-alpine"
22
ARG PHP_BUILD_DATE="20250925"
33

44
FROM $BASE_IMAGE AS compile
@@ -168,9 +168,7 @@ RUN pecl install opentelemetry-${PHP_OPENTELEMETRY_VERSION}
168168
FROM compile AS protobuf
169169
RUN pecl install protobuf-${PHP_PROTOBUF_VERSION}
170170

171-
# FROM $BASE_IMAGE AS final
172-
FROM "phpswoole/swoole:php8.5-alpine" AS final
173-
171+
FROM $BASE_IMAGE AS final
174172

175173
# Pass in ARGS to use as label values and path components
176174

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ In order to run this container you'll need the Docker runtime installed.
3737
## Build
3838

3939
```shell
40-
docker-buildx build --no-cache --tag appwrite/base:latest .
40+
docker buildx --no-cache --tag appwrite/base:latest .
4141
# exit code 0
4242
```
4343

@@ -77,7 +77,7 @@ docker run appwrite/base:latest php -m
7777

7878
## Push
7979

80-
Note: Build of the image and push to the registry shoudl be handle by automation.
80+
Pushing a built image to a repository should be handle by automation.
8181

8282
```bash
8383
docker push appwrite/base:latest | tee "push-$(date +%s).log"

0 commit comments

Comments
 (0)