build-labels 0.0.84 → 0.0.85

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71200ab2745bc6b72e3713bd05be3dfc01335ace3d0e69a812b0543cabb2dcb5
-  data.tar.gz: 114e09c1f436d4d213b1b70598677f85a2c78960f0c518a5acbb8a479135c5b3
+  metadata.gz: e3a02e5fbc875e7810f24fd48b1d054e1ba42c4fc31830d37f1131da08033305
+  data.tar.gz: b810cae6b722b0f962684197fedf83cb7eacf3da71ee52c7a61c1dbac3a3b689
 SHA512:
-  metadata.gz: c92119e261e7d30b83efd45dd59947c5da00b5af72f7dd7ff864c98328e73c5530160e0707677382807fe07d21c4a8bf91b5f1f844adbc2b7cfb9749f08275b0
-  data.tar.gz: 6b335e9538786713aed349357ed2a4bb7491785454f9e6817f49377291670b128b4e326e28f52a89f475afa3a5246420a7160e8625c1f4dcd56dfc29c3d9e90a
+  metadata.gz: 5513b81dda0b4547c93953ef3e907f4c55b32fd632e5a7f7896b6c8a4fcc52370912a156a2d54b74928bcd364d11fdfa210f8cf4a7376a56971a5cb3fe1db8d9
+  data.tar.gz: 863c93ea012458fc841035e8e21a3153cdc6328bd2c932daa30a20c77b29caeb009474e0dfb318cbb1f56c3ab771ea61bbee00b88ab94e057324010896edd692

data/bin/install-trivy-static

@@ -0,0 +1,98 @@
+#!/usr/bin/env ruby
+text = File.read(__FILE__)
+shell = text.split(/^__END__\s*$/, 2)[1] or abort('missing __END__')
+exec 'sh', '-eu', '-c', shell, 'sh', *ARGV
+
+__END__
+set -eu
+
+trivy_version="0.74.0"
+
+curl_fetch() {
+    curl -fsSL \
+        --retry "${CURL_RETRIES:-3}" \
+        --retry-delay "${CURL_RETRY_DELAY:-2}" \
+        --retry-all-errors \
+        --connect-timeout "${CURL_CONNECT_TIMEOUT:-10}" \
+        --max-time "${CURL_MAX_TIME:-120}" \
+        "$@"
+}
+
+usage() {
+    cat <<USAGE
+Usage: install-trivy-static
+
+Installs pinned Trivy ${trivy_version} to /usr/local/bin/trivy.
+
+Options:
+  -h, --help  Show this help
+USAGE
+}
+
+if [ "$#" -gt 0 ]; then
+    case "$1" in
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unexpected argument: $1" >&2
+            usage
+            exit 1
+            ;;
+    esac
+fi
+
+case "$(uname -m)" in
+    x86_64|amd64)
+        trivy_arch="64bit"
+        trivy_sha256="2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"
+        ;;
+    aarch64|arm64)
+        trivy_arch="ARM64"
+        trivy_sha256="b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5"
+        ;;
+    armv7l|armv7|armv6l|armv6)
+        trivy_arch="ARM"
+        trivy_sha256="99adbe319fa685cb4bff04dd0077e31cb94828338cab5db7f78fe6dcecca8ec1"
+        ;;
+    ppc64le)
+        trivy_arch="PPC64LE"
+        trivy_sha256="c5aabfe8789d0d43f578ef2d01174884c8ff0f2106c627a220a43f7bf9054959"
+        ;;
+    s390x)
+        trivy_arch="s390x"
+        trivy_sha256="516cfe38eaede79c178088265657aad12be6c155271ac68ff728a141961ef197"
+        ;;
+    *)
+        echo "Unsupported architecture: $(uname -m)" >&2
+        exit 1
+        ;;
+esac
+
+if command -v apt-get >/dev/null 2>&1; then
+    apt-get update
+    apt-get install -y --no-install-recommends ca-certificates coreutils curl tar
+    cleanup_packages="apt"
+elif command -v apk >/dev/null 2>&1; then
+    apk add --no-cache ca-certificates coreutils curl tar
+    cleanup_packages=""
+else
+    echo "Unsupported package manager: expected apt or apk." >&2
+    exit 1
+fi
+
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT HUP INT TERM
+archive="trivy_${trivy_version}_Linux-${trivy_arch}.tar.gz"
+archive_path="${tmp_dir}/${archive}"
+curl_fetch "https://github.com/aquasecurity/trivy/releases/download/v${trivy_version}/${archive}" -o "$archive_path"
+printf '%s  %s\n' "$trivy_sha256" "$archive_path" | sha256sum -c -
+tar -xzf "$archive_path" -C "$tmp_dir" trivy
+install -m 0755 "$tmp_dir/trivy" /usr/local/bin/trivy
+
+if [ "$cleanup_packages" = "apt" ]; then
+    rm -rf /var/lib/apt/lists/*
+fi
+
+trivy --version

data/lib/trivy-runner.rb

@@ -6,9 +6,21 @@ require 'yaml'
 require_relative 'version'
 
 class TrivyRunner
+  DEFAULT_CACHE_DIR = '/root/.cache/trivy'.freeze
   IMAGE_ID = /\Asha256:[0-9a-f]{64}\z/
 
   def run(args)
+    return run_filesystems(args.drop(1)) if args.first == 'fs'
+
+    run_images(args)
+  rescue StandardError => error
+    warn error.message
+    1
+  end
+
+  private
+
+  def run_images(args)
     file = 'bake.yml'
     metadata_file = nil
     tty = true
@@ -41,16 +53,43 @@ class TrivyRunner
     verify_images(images)
     warn "\e[32mTrivy checks passed.#{trivy_args.empty? ? '' : " Options: #{trivy_args.shelljoin}"}\e[0m"
     0
-  rescue StandardError => error
-    warn error.message
-    1
   end
 
-  private
+  def run_filesystems(args)
+    file = 'bake.yml'
+    cache_dir = nil
+    parser = OptionParser.new do |options|
+      options.banner = 'Usage: trivy-runner fs -f COMPOSE_FILE [--cache-dir DIR] [-- TRIVY_OPTIONS ...]'
+      options.separator 'Scans every unique local service build context with native trivy fs.'
+      options.separator 'Options after -- are forwarded to trivy fs.'
+      options.on('-f', '--file FILE', 'Compose file (default: bake.yml)') { file = _1 }
+      options.on('--cache-dir DIR', 'Trivy cache directory (default: TRIVY_CACHE_DIR or /root/.cache/trivy)') do
+        cache_dir = _1
+      end
+      options.on('-v', '--version', 'Print version') { puts BuildLabels::Builder::VERSION; return 0 }
+      options.on('-h', '--help', 'Print help') { puts options; return 0 }
+    end
+    separator = args.index('--') || args.length
+    trivy_args = args.drop(separator + 1)
+    unexpected = parser.parse!(args.take(separator))
+    raise OptionParser::InvalidOption, "Unexpected argument: #{unexpected.first}" unless unexpected.empty?
+
+    contexts = filesystem_contexts(file)
+    return 0 if contexts.empty?
+
+    cache_dir ||= ENV.fetch('TRIVY_CACHE_DIR', DEFAULT_CACHE_DIR)
+    contexts.each do |path, services|
+      warn "\n\e[36m=== Trivy fs scan: #{services.join(', ')} ===\nPath: #{path}\e[0m"
+      status = scan_filesystem(path, cache_dir, trivy_args)
+      return status unless status.zero?
+    end
+    warn "\e[32mTrivy fs checks passed.#{trivy_args.empty? ? '' : " Options: #{trivy_args.shelljoin}"}\e[0m"
+    0
+  end
 
   def scan(image_id, trivy_args, tty)
     environment = ENV.keys.grep(/\ATRIVY_/) - %w[TRIVY_IMAGE]
-    cache_dir = ENV.fetch('TRIVY_CACHE_DIR', '/root/.cache/trivy')
+    cache_dir = ENV.fetch('TRIVY_CACHE_DIR', DEFAULT_CACHE_DIR)
     system('docker', 'run', '--rm', '--pull', 'always', *(tty ? ['--tty'] : []),
            '--mount', 'type=bind,src=/var/run/docker.sock,dst=/var/run/docker.sock,readonly',
            '--mount', "type=volume,src=trivy-cache,dst=#{cache_dir}",
@@ -59,6 +98,50 @@ class TrivyRunner
            '--exit-code', '1', *trivy_args, image_id)
   end
 
+  def scan_filesystem(path, cache_dir, trivy_args)
+    pid = Process.spawn('trivy', 'fs', '--cache-dir', cache_dir, *trivy_args, path)
+    status = Process.wait2(pid).last
+    status.exited? ? status.exitstatus : 128 + status.termsig
+  rescue Errno::ENOENT
+    warn 'Trivy executable not found. Install it with install-trivy-static.'
+    127
+  end
+
+  def filesystem_contexts(file)
+    compose = YAML.safe_load(File.read(file), aliases: true)
+    services = compose.is_a?(Hash) && compose['services']
+    raise 'Invalid Compose services map' unless services.is_a?(Hash)
+
+    base_dir = File.dirname(File.expand_path(file))
+    services.each_with_object({}) do |(name, service), contexts|
+      raise "Invalid Compose service: #{name}" unless service.is_a?(Hash)
+      next unless service.key?('build')
+
+      context = build_context(name, service['build'])
+      raise "Unresolved build context for service #{name}: #{context}" if context.include?('$')
+      raise "Remote build context is not supported for service #{name}: #{context}" if remote_context?(context)
+
+      path = File.expand_path(context, base_dir)
+      raise "Build context is not a directory for service #{name}: #{path}" unless File.directory?(path)
+
+      (contexts[File.realpath(path)] ||= []) << name
+    end
+  end
+
+  def build_context(name, build)
+    context = case build
+              when String then build
+              when Hash then build.fetch('context', '.')
+              end
+    raise "Invalid build configuration for service #{name}" unless context.is_a?(String) && !context.empty?
+
+    context
+  end
+
+  def remote_context?(context)
+    context.match?(%r{\A(?:[a-z][a-z0-9+.-]*://|git@|service:)}i)
+  end
+
   def empty_compose?(file)
     document = YAML.safe_load(File.read(file), aliases: true)
     document.is_a?(Hash) && document['services'] == {}

data/lib/version.rb

@@ -1,5 +1,5 @@
 module BuildLabels
   class Builder
-    VERSION = '0.0.84'
+    VERSION = '0.0.85'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: build-labels
 version: !ruby/object:Gem::Version
-  version: 0.0.84
+  version: 0.0.85
 platform: ruby
 authors:
 - Artyom B
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-09 00:00:00.000000000 Z
+date: 2026-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -101,12 +101,14 @@ executables:
 - helm-push
 - trivy-runner
 - install-docker-static
+- install-trivy-static
 extensions: []
 extra_rdoc_files: []
 files:
 - bin/build-labels
 - bin/helm-push
 - bin/install-docker-static
+- bin/install-trivy-static
 - bin/trivy-runner
 - examples/Dockerfile
 - examples/common-compose.yml