From 7499f96aa6e1f4457492ac070a29080c923a28ff Mon Sep 17 00:00:00 2001 From: Jacob Woffenden Date: Thu, 11 Apr 2024 12:25:00 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=9A=80=20Prepare=20for=20general=20availa?= =?UTF-8?q?bility=20=20(#41)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jacob Woffenden --- .devcontainer/devcontainer-lock.json | 13 + .devcontainer/devcontainer.json | 4 +- .github/workflows/build-and-test.yml | 6 +- .github/workflows/scan-image.yml | 2 +- Dockerfile | 256 ++++++++++-------- Makefile | 15 + scripts/build-and-test.sh | 24 -- src/etc/bash.bashrc.snippet | 7 + .../visual-studio-code/first-run-notice.txt | 5 +- test/container-structure-test.yml | 1 - 10 files changed, 194 insertions(+), 139 deletions(-) create mode 100644 Makefile delete mode 100755 scripts/build-and-test.sh create mode 100644 src/etc/bash.bashrc.snippet diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json index d6a6a30..0a7dbec 100644 --- a/.devcontainer/devcontainer-lock.json +++ b/.devcontainer/devcontainer-lock.json @@ -4,6 +4,19 @@ "version": "2.10.1", "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:440bdb81cf8af43f3e922450d33db9775c1097340557a5b7b6fe705bc758c5ef", "integrity": "sha256:440bdb81cf8af43f3e922450d33db9775c1097340557a5b7b6fe705bc758c5ef" + }, + "ghcr.io/ministryofjustice/devcontainer-feature/container-structure-test:0": { + "version": "0.0.2", + "resolved": "ghcr.io/ministryofjustice/devcontainer-feature/container-structure-test@sha256:a0d81a6b8be5deae2fc41edf007a8f0efe794b4ebf0880265643b4a06edf16c6", + "integrity": "sha256:a0d81a6b8be5deae2fc41edf007a8f0efe794b4ebf0880265643b4a06edf16c6", + "dependsOn": [ + "ghcr.io/devcontainers/features/docker-in-docker:2" + ] + }, + "ghcr.io/ministryofjustice/devcontainer-feature/static-analysis:0": { + "version": "0.0.3", + "resolved": "ghcr.io/ministryofjustice/devcontainer-feature/static-analysis@sha256:81efa45affc66c168d273817f6f86a64f90715e9482eb7f6e3b33af006a2236c", + "integrity": "sha256:81efa45affc66c168d273817f6f86a64f90715e9482eb7f6e3b33af006a2236c" } } } \ No newline at end of file diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 24ad642..84f109c 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -2,7 +2,9 @@ "name": "analytical-platform-visual-studio-code", "image": "ghcr.io/ministryofjustice/devcontainer-base:latest", "features": { - "ghcr.io/devcontainers/features/docker-in-docker:2": {} + "ghcr.io/devcontainers/features/docker-in-docker:2": {}, + "ghcr.io/ministryofjustice/devcontainer-feature/container-structure-test:0": {}, + "ghcr.io/ministryofjustice/devcontainer-feature/static-analysis:0": {} }, "customizations": { "vscode": { diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index e29650b..97162cf 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -19,8 +19,12 @@ jobs: id: checkout uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 + - name: Set Up Container Structure Test + id: setup_container_structure_test + uses: ministryofjustice/github-actions/setup-container-structure-test@bdab1cff6d23336b6d5adc662fb57af72f0ae160 # v17.1.0 + - name: Build and Test id: build_and_test shell: bash run: | - bash scripts/build-and-test.sh + make test diff --git a/.github/workflows/scan-image.yml b/.github/workflows/scan-image.yml index a03df5f..1dd0773 100644 --- a/.github/workflows/scan-image.yml +++ b/.github/workflows/scan-image.yml @@ -52,6 +52,6 @@ jobs: - name: Upload SARIF if: always() id: upload_sarif - uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.2.7 + uses: github/codeql-action/upload-sarif@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3.24.10 with: sarif_file: trivy-results.sarif diff --git a/Dockerfile b/Dockerfile index c1765a0..ecf1b6c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,10 @@ -FROM public.ecr.aws/ubuntu/ubuntu@sha256:722b3bddfe96b95441f626cf94974d79213090ecbd16954f71d7c080fb413561 +FROM public.ecr.aws/ubuntu/ubuntu@sha256:12fb86d81bc4504d8261a91c83c54b9e5dcdf1d833ba0fe42ec9e0ee09a2b0ba LABEL org.opencontainers.image.vendor="Ministry of Justice" \ org.opencontainers.image.authors="Analytical Platform (analytical-platform@digital.justice.gov.uk)" \ org.opencontainers.image.title="Visual Studio Code" \ org.opencontainers.image.description="Visual Studio Code image for Analytical Platform" \ - org.opencontainers.image.url="https://github.com/ministryofjustice/analytical-platform" + org.opencontainers.image.url="https://github.com/ministryofjustice/analytical-platform-visual-studio-code" ENV CONTAINER_USER="analyticalplatform" \ CONTAINER_UID="1000" \ @@ -12,142 +12,184 @@ ENV CONTAINER_USER="analyticalplatform" \ CONTAINER_GID="1000" \ DEBIAN_FRONTEND="noninteractive" \ VISUAL_STUDIO_CODE_VERSION="1.88.0-1712152114" \ - AWS_CLI_VERSION="2.15.35" \ + AWS_CLI_VERSION="2.15.37" \ CORRETTO_VERSION="1:21.0.2.14-1" \ MINICONDA_VERSION="24.1.2-0" \ MINICONDA_SHA256="8eb5999c2f7ac6189690d95ae5ec911032fa6697ae4b34eb3235802086566d78" \ - DOTNET_SDK_VERSION="8.0.203-1" \ - OLLAMA_VERSION="0.1.30" \ - OLLAMA_SHA256="cee140fdbbe1b21b520a83bf6246ca727df3cd69db560d6cf579888a4b966c93" \ + DOTNET_SDK_VERSION="8.0.204-1" \ + OLLAMA_VERSION="0.1.31" \ + OLLAMA_SHA256="9d9a24ed741bf9d88c8e9df6865371681316aee298433d0291e86295045bfa96" \ PATH="/opt/conda/bin:${HOME}/.local/bin:${PATH}" -SHELL ["/bin/bash", "-o", "pipefail", "-c"] +SHELL ["/bin/bash", "-e", "-u", "-o", "pipefail", "-c"] -# User -RUN groupadd \ - --gid ${CONTAINER_GID} \ - ${CONTAINER_GROUP} \ - && useradd \ - --uid ${CONTAINER_UID} \ - --gid ${CONTAINER_GROUP} \ - --create-home \ - --shell /bin/bash \ - ${CONTAINER_USER} +# User Configuration +RUN <> /etc/bash.bashrc +cp /home/analyticalplatform/.bash_logout /opt/visual-studio-code/.bash_logout -#ย This is a first run notice for Visual Studio Code -if [[ -t 1 ]] && [[ "\${TERM_PROGRAM}" = "vscode" ]] && [[ ! -f "/home/analyticalplatform/.vscode/first-run-notice-already-displayed" ]]; then - cat /opt/visual-studio-code/first-run-notice.txt - # Mark first run notice as displayed after 10s to avoid problems with fast terminal refreshes hiding it - mkdir --parents "/home/analyticalplatform/.vscode" - ((sleep 10s; touch "/home/analyticalplatform/.vscode/first-run-notice-already-displayed") &) -fi +cp /home/analyticalplatform/.profile /opt/visual-studio-code/.profile +EOF +# First run notice +COPY src/opt/visual-studio-code/first-run-notice.txt /opt/visual-studio-code/first-run-notice.txt +COPY src/etc/bash.bashrc.snippet /etc/bash.bashrc.snippet +RUN <> /etc/bash.bashrc EOF # Visual Studio Code -RUN curl --location --fail-with-body \ - "https://packages.microsoft.com/keys/microsoft.asc" \ - --output microsoft.asc \ - && cat microsoft.asc | gpg --dearmor --output packages.microsoft.gpg \ - && install -D --owner root --group root --mode 644 packages.microsoft.gpg /etc/apt/keyrings/packages.microsoft.gpg \ - && echo "deb [arch=amd64,arm64,armhf signed-by=/etc/apt/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/repos/code stable main" > /etc/apt/sources.list.d/vscode.list \ - && apt-get update --yes \ - && apt-get install --yes \ - "code=${VISUAL_STUDIO_CODE_VERSION}" \ - && apt-get clean --yes \ - && rm --force --recursive /var/lib/apt/lists/* +RUN < /etc/apt/sources.list.d/vscode.list + +apt-get update --yes + +apt-get install --yes "code=${VISUAL_STUDIO_CODE_VERSION}" + +apt-get clean --yes + +rm --force --recursive packages.microsoft.gpg /var/lib/apt/lists/* +EOF # AWS CLI COPY --chown=nobody:nobody --chmod=0755 src/opt/aws-cli/aws-cli@amazon.com.asc /opt/aws-cli/aws-cli@amazon.com.asc -RUN gpg --import /opt/aws-cli/aws-cli@amazon.com.asc \ - && curl --location --fail-with-body \ - "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWS_CLI_VERSION}.zip.sig" \ - --output "awscliv2.sig" \ - && curl --location --fail-with-body \ - "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWS_CLI_VERSION}.zip" \ - --output "awscliv2.zip" \ - && gpg --verify awscliv2.sig awscliv2.zip \ - && unzip awscliv2.zip \ - && ./aws/install \ - && rm --force --recursive awscliv2.sig awscliv2.zip aws +RUN < /etc/apt/sources.list.d/corretto.list \ - && apt-get update --yes \ - && apt-get install --yes \ - "java-21-amazon-corretto-jdk=${CORRETTO_VERSION}" \ - && apt-get clean --yes \ - && rm --force --recursive /var/lib/apt/lists/* +RUN < /etc/apt/sources.list.d/corretto.list + +apt-get update --yes + +apt-get install --yes "java-21-amazon-corretto-jdk=${CORRETTO_VERSION}" + +apt-get clean --yes + +rm --force --recursive corretto-keyring.gpg /var/lib/apt/lists/* +EOF # Miniconda -RUN curl --location --fail-with-body \ - "https://repo.anaconda.com/miniconda/Miniconda3-py310_${MINICONDA_VERSION}-Linux-x86_64.sh" \ - --output "miniconda.sh" \ - && echo "${MINICONDA_SHA256} miniconda.sh" | sha256sum --check \ - && bash miniconda.sh -b -p /opt/conda \ - && chown --recursive "${CONTAINER_USER}":"${CONTAINER_GROUP}" /opt/conda \ - && rm --force miniconda.sh +RUN <