Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Integrate Static Code Analysis Tools #24

Merged
merged 7 commits into from
Apr 30, 2024
Merged

Integrate Static Code Analysis Tools #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
dbc42d9
Add CI linting and security scan
sbreker Apr 17, 2024
4c7cf4e
Set secure SHELL options before RUN
sbreker Apr 25, 2024
5bc300c
Add HEALTHCHECK to Dockerfile
sbreker Apr 25, 2024
b54e91b
Skip rule SC2086 for 'apk add $runDeps'
sbreker Apr 26, 2024
8a126f6
Run wget with -q option
sbreker Apr 26, 2024
10f8a72
Ignore Hadolint rule DL3019 use '--no-cache'
sbreker Apr 28, 2024
2478b6a
Disable Hadolint rules
sbreker Apr 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
name: Lint and Security Check

on:
pull_request:
push:
branches:
- main

permissions: read-all

jobs:
shellcheck:
name: Lint Shell Scripts with ShellCheck
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v3

- name: Run ShellCheck
uses: ludeeus/action-shellcheck@master
with:
scandir: './1.1.21.2'

hadolint:
name: Lint Dockerfiles with Hadolint
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v3

- name: Run Hadolint with GitHub Action
uses: hadolint/[email protected]
with:
dockerfile: 1.1.21.2/Dockerfile
failure-threshold: warning
ignore: DL3018,DL3003

checkov:
name: Run Checkov for Dockerfile Security Analysis
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v3

- name: Run Checkov with GitHub Action
uses: bridgecrewio/checkov-action@master
with:
directory: 1.1.21.2/
quiet: false
14 changes: 10 additions & 4 deletions 1.1.21.2/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,13 @@ FROM alpine:3.19.1
ENV GEARMAND_VERSION 1.1.21
ENV GEARMAND_SHA1 472d2a0019e69edefcd0c1ff57e9352982e6d3f5

SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]

RUN addgroup -S gearman && adduser -G gearman -S -D -H -s /bin/false -g "Gearman Server" gearman

RUN set -x \
&& apk add --no-cache --virtual .build-deps \
# Package list 'runDeps' is programmatically generated.
# hadolint ignore=SC2086, DL3019
RUN apk add --no-cache --virtual .build-deps \
wget \
tar \
ca-certificates \
Expand All @@ -20,7 +23,7 @@ RUN set -x \
hiredis-dev \
mariadb-dev \
libmemcached-dev \
&& wget -O gearmand.tar.gz "https://github.com/gearman/gearmand/releases/download/$GEARMAND_VERSION/gearmand-$GEARMAND_VERSION.tar.gz" \
&& wget -O gearmand.tar.gz -q "https://github.com/gearman/gearmand/releases/download/$GEARMAND_VERSION/gearmand-$GEARMAND_VERSION.tar.gz" \
&& echo "$GEARMAND_SHA1 gearmand.tar.gz" | sha1sum -c - \
&& mkdir -p /usr/src/gearmand \
&& tar -xzf gearmand.tar.gz -C /usr/src/gearmand --strip-components=1 \
Expand All @@ -44,13 +47,16 @@ RUN set -x \
scanelf --needed --nobanner --recursive /usr/local \
| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
| sort -u \
| xargs -r apk info --installed \
| xargs -r apk info --installed || true \
| sort -u \
)" \
&& apk add --virtual .gearmand-rundeps $runDeps \
&& apk del .build-deps \
&& /usr/local/sbin/gearmand --version

HEALTHCHECK --interval=5m --timeout=3s --retries=2 \
CMD test $(netstat -ltn | grep -c :$GEARMAND_LISTEN_PORT) -eq 1 || exit 1

COPY docker-entrypoint.sh /usr/local/bin/
RUN apk add --no-cache bash \
&& touch /etc/gearmand.conf && chown gearman:gearman /etc/gearmand.conf \
Expand Down
Loading