generated from ministryofjustice/template-repository
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
first test at passing image for the image build template (#1)
* first test at passing image * move file
- Loading branch information
Showing
8 changed files
with
259 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| root = true | ||
|
|
||
| [*] | ||
| end_of_line = lf | ||
| insert_final_newline = true | ||
| trim_trailing_whitespace = true | ||
|
|
||
| [*.json] | ||
| indent_style = space | ||
| indent_size = 2 | ||
|
|
||
| [*.sh] | ||
| indent_style = space | ||
| indent_size = 2 | ||
|
|
||
| [{*.yml,*.yaml}] | ||
| indent_style = space | ||
| indent_size = 2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| --- | ||
| name: Build and Test | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: | ||
| - main | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| build-and-test: | ||
| name: Build and Test | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Checkout | ||
| id: checkout | ||
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | ||
|
|
||
| - name: Build and Test | ||
| id: build_and_test | ||
| shell: bash | ||
| run: | | ||
| bash scripts/build-and-test.sh |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| --- | ||
| name: Release | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - "*" | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| release: | ||
| name: Release | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| packages: write | ||
| steps: | ||
| - name: Checkout | ||
| id: checkout | ||
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | ||
|
|
||
| - name: Install cosign | ||
| id: install_cosign | ||
| uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0 | ||
|
|
||
| - name: Log in to GitHub Container Registry | ||
| id: login_ghcr | ||
| uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and Push | ||
| id: build_and_push | ||
| uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 | ||
| with: | ||
| push: true | ||
| tags: ghcr.io/${{ github.repository }}:${{ github.ref_name }} | ||
|
|
||
| - name: Sign | ||
| id: sign | ||
| shell: bash | ||
| run: | | ||
| cosign sign --yes ghcr.io/${{ github.repository }}@${{ steps.build_and_push.outputs.digest }} | ||
| - name: Verify | ||
| id: verify | ||
| run: | | ||
| cosign verify \ | ||
| --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ | ||
| --certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release.yml@refs/tags/${{ github.ref_name }} \ | ||
| ghcr.io/${{ github.repository }}@${{ steps.build_and_push.outputs.digest }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| --- | ||
| name: Super-Linter | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: | ||
| - main | ||
| types: | ||
| - edited | ||
| - opened | ||
| - reopened | ||
| - synchronize | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| super-linter: | ||
| name: Super-Linter | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| statuses: write | ||
| steps: | ||
| - name: Checkout | ||
| id: checkout | ||
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Run Super-Linter | ||
| id: super_linter | ||
| uses: super-linter/super-linter/slim@e0fc164bba85f4b58c6cd17ba1dfd435d01e8a06 # v6.3.0 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # checkov:skip=CKV_DOCKER_2:Healthcheck instructions have not been added to container images | ||
| #This image is an example base image for this template and can be replaced to fit user needs | ||
| FROM public.ecr.aws/ubuntu/ubuntu@sha256:722b3bddfe96b95441f626cf94974d79213090ecbd16954f71d7c080fb413561 | ||
|
|
||
| LABEL org.opencontainers.image.vendor="Ministry of Justice" \ | ||
| org.opencontainers.image.authors="Analytical Platform ([email protected])"\ | ||
| org.opencontainers.image.title="{image title}" \ | ||
| org.opencontainers.image.description="{decription}" \ | ||
| org.opencontainers.image.url="{your repo url}" | ||
|
|
||
| ENV CONTAINER_USER="analyticalplatform" \ | ||
| CONTAINER_UID="1000" \ | ||
| CONTAINER_GROUP="analyticalplatform" \ | ||
| CONTAINER_GID="1000" \ | ||
| DEBIAN_FRONTEND="noninteractive" | ||
|
|
||
| # User | ||
| RUN groupadd \ | ||
| --gid ${CONTAINER_GID} \ | ||
| ${CONTAINER_GROUP} \ | ||
| && useradd \ | ||
| --uid ${CONTAINER_UID} \ | ||
| --gid ${CONTAINER_GROUP} \ | ||
| --create-home \ | ||
| --shell /bin/bash \ | ||
| ${CONTAINER_USER} | ||
|
|
||
| # Base | ||
| RUN apt-get update --yes \ | ||
| && apt-get install --yes \ | ||
| "apt-transport-https=2.4.11" \ | ||
| "curl=7.81.0-1ubuntu1.15" \ | ||
| "git=1:2.34.1-1ubuntu1.10" \ | ||
| "gpg=2.2.27-3ubuntu2.1" \ | ||
| "python3.10=3.10.12-1~22.04.3" \ | ||
| "python3-pip=22.0.2+dfsg-1ubuntu0.4" \ | ||
| "unzip=6.0-26ubuntu3.2" \ | ||
| && apt-get clean --yes \ | ||
| && rm --force --recursive /var/lib/apt/lists/* | ||
|
|
||
| USER ${CONTAINER_USER} | ||
|
|
||
| WORKDIR /home/${CONTAINER_USER} | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| IMAGE_TAG="analytical-platform.service.justice.gov.uk/template-base:local" | ||
| CONTAINER_STRUCTURE_TEST_IMAGE="gcr.io/gcp-runtimes/container-structure-test:latest" | ||
|
|
||
| if [[ "${REMOTE_CONTAINERS}" ]] && [[ "$(uname -m)" == "aarch64" ]]; then | ||
| echo "(⚠) Looks like you're running in a dev container on Apple Silicon." | ||
| echo "(⚠) This script builds linux/amd64 images which might take a long time or even fail." | ||
| export PLATFORM_FLAG="--platform linux/amd64" | ||
| fi | ||
| # shellcheck disable=SC2086 | ||
| # special case for PLATFORM_FLAG as it can't parse double quotes | ||
| docker build ${PLATFORM_FLAG} --file Dockerfile --tag "${IMAGE_TAG}" . | ||
|
|
||
| echo "Running container structure test for [ ${IMAGE_TAG} ]" | ||
|
|
||
| # shellcheck disable=SC2086 | ||
| # special case for PLATFORM_FLAG as it can't parse double quotes | ||
| docker run --rm ${PLATFORM_FLAG} \ | ||
| --volume /var/run/docker.sock:/var/run/docker.sock \ | ||
| --volume "${PWD}:/workspace" \ | ||
| --workdir /workspace \ | ||
| "${CONTAINER_STRUCTURE_TEST_IMAGE}" \ | ||
| test --image "${IMAGE_TAG}" --config "/workspace/test/container-structure-test.yml" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| --- | ||
| schemaVersion: 2.0.0 | ||
|
|
||
| containerRunOptions: | ||
| user: "analyticalplatform" | ||
|
|
||
| commandTests: | ||
| - name: "ubuntu" | ||
| command: "grep" | ||
| args: ["DISTRIB_RELEASE", "/etc/lsb-release"] | ||
| expectedOutput: ["DISTRIB_RELEASE=22.04"] | ||
|
|
||
| - name: "whoami" | ||
| command: "whoami" | ||
| expectedOutput: ["analyticalplatform"] | ||
|
|
||
| - name: "user" | ||
| command: "id" | ||
| args: ["--user", "analyticalplatform"] | ||
| expectedOutput: ["1000"] | ||
|
|
||
| - name: "groups" | ||
| command: "id" | ||
| args: ["--groups", "analyticalplatform"] | ||
| expectedOutput: ["100"] |