stack-service-base 0.0.104 → 0.0.105
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/stack-service-base/project_template/gitlab/docker/Dockerfile.build +17 -30
- data/lib/stack-service-base/project_template/gitlab-c/docker/Dockerfile.build +17 -11
- data/lib/stack-service-base/project_template/home/src/Rakefile +36 -0
- data/lib/stack-service-base/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 06ae719b529bdc2937204a4dc72cd391fdbb77a62f7308c17af01e282a376cda
|
|
4
|
+
data.tar.gz: 06ba7b4c00ed0ef9e2b4e1f0ed3adf011c5800e523b78983b5fd6a8ccab23f5a
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: e47c35b7c3866b1601a4ffc5a76efd83c65043e5a4fc83b637b505ced2f9e9f5941c9485d455564246d35d9f3396ad2fbc5ecb246f4b5214904d576f783743e9
|
|
7
|
+
data.tar.gz: 238432ac55ce910326b4905a2db84b4e3dc90ffae530be2ac27aa7906442db59a056f295b80b6d8af3d07a67b78803fd571c2ca5edfb2eb778dd09e97daa2a2f
|
|
@@ -1,36 +1,23 @@
|
|
|
1
|
-
FROM ruby:3.4.
|
|
2
|
-
RUN apt-get update && apt-get install -y --no-install-recommends bash ca-certificates curl
|
|
3
|
-
|
|
4
|
-
RUN
|
|
5
|
-
RUN BUILDX_VERSION=v0.20.1 COMPOSE_VERSION=v2.33.0 install-docker-static 27.5.1
|
|
1
|
+
FROM ruby:3.4.10-slim-bookworm AS base
|
|
2
|
+
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends bash git jq ca-certificates curl tar
|
|
3
|
+
RUN gem install build-labels:0.0.84
|
|
4
|
+
RUN install-docker-static
|
|
6
5
|
|
|
7
6
|
WORKDIR /build
|
|
7
|
+
COPY . .
|
|
8
8
|
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
CMD ["bash", "-euo", "pipefail", "-c", "\
|
|
9
|
+
CMD ["bash", "-e", "-o", "pipefail", "-c", "\
|
|
12
10
|
cd /build/docker; \
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
if grep -q \"services: {}\" bake.yml; then \
|
|
22
|
-
echo \"No changed services to build.\"; \
|
|
23
|
-
exit 0; \
|
|
24
|
-
fi; \
|
|
25
|
-
docker buildx create --name \"${service_name}-builder\" --driver docker-container --use || docker buildx use \"${service_name}-builder\"; \
|
|
26
|
-
docker buildx inspect --bootstrap; \
|
|
27
|
-
if [ -n \"${CI_SKIP_PUSH:-}\" ]; then \
|
|
28
|
-
docker buildx bake --load --allow=fs.read=../src -f bake.yml; \
|
|
29
|
-
else \
|
|
30
|
-
docker buildx bake --push --allow=fs.read=../src -f bake.yml; \
|
|
11
|
+
build-labels -n -c docker-compose.yml changed gitlab set_version to_dockerfiles to_compose | tee bake.yml; \
|
|
12
|
+
export OTEL_RESOURCE_ATTRIBUTES=\"service.name=docker-builder,pipeline.id=${CI_PIPELINE_ID:-},project.name=${CI_PROJECT_NAME:-}\"; \
|
|
13
|
+
export REGISTRY_HOST=\"${CI_REGISTRY_HOST:-}\" BUILDX_BAKE_ENTITLEMENTS_FS=0; \
|
|
14
|
+
grep -q '^services: {}$' bake.yml && exit 0; \
|
|
15
|
+
docker buildx bake -f bake.yml --set '*.output=type=docker' --sbom=false --provenance=false --metadata-file /tmp/bake-metadata.json; \
|
|
16
|
+
if [ \"${CI_BUILD_TARGET:-}\" = tests ]; then \
|
|
17
|
+
docker compose -f bake.yml down --remove-orphans; \
|
|
18
|
+
docker compose -f bake.yml up --force-recreate --no-build --pull never --abort-on-container-failure; \
|
|
31
19
|
fi; \
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
fi \
|
|
20
|
+
trivy-runner -f bake.yml --metadata-file /tmp/bake-metadata.json -- --severity HIGH,CRITICAL --ignore-unfixed --table-mode detailed; \
|
|
21
|
+
[ -z \"${CI_SKIP_PUSH:-}\" ] || exit 0; \
|
|
22
|
+
docker compose -f bake.yml push;\
|
|
36
23
|
"]
|
|
@@ -1,17 +1,23 @@
|
|
|
1
|
-
FROM ruby:3.4.
|
|
2
|
-
RUN apt update && apt install -y --no-install-recommends bash git
|
|
3
|
-
RUN gem install build-labels:0.0.
|
|
1
|
+
FROM ruby:3.4.10-slim-bookworm AS base
|
|
2
|
+
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends bash git jq ca-certificates curl tar
|
|
3
|
+
RUN gem install build-labels:0.0.84
|
|
4
4
|
RUN install-docker-static
|
|
5
5
|
|
|
6
6
|
WORKDIR /build
|
|
7
|
-
|
|
8
7
|
COPY . .
|
|
9
8
|
|
|
10
|
-
CMD ["bash", "-
|
|
11
|
-
|
|
12
|
-
build-labels -n -c docker-compose.yml changed gitlab set_version to_dockerfiles to_compose | tee bake.yml
|
|
13
|
-
export OTEL_RESOURCE_ATTRIBUTES
|
|
14
|
-
export REGISTRY_HOST
|
|
15
|
-
|
|
16
|
-
|
|
9
|
+
CMD ["bash", "-e", "-o", "pipefail", "-c", "\
|
|
10
|
+
cd /build/docker; \
|
|
11
|
+
build-labels -n -c docker-compose.yml changed gitlab set_version to_dockerfiles to_compose | tee bake.yml; \
|
|
12
|
+
export OTEL_RESOURCE_ATTRIBUTES=\"service.name=docker-builder,pipeline.id=${CI_PIPELINE_ID:-},project.name=${CI_PROJECT_NAME:-}\"; \
|
|
13
|
+
export REGISTRY_HOST=\"${CI_REGISTRY_HOST:-}\" BUILDX_BAKE_ENTITLEMENTS_FS=0; \
|
|
14
|
+
grep -q '^services: {}$' bake.yml && exit 0; \
|
|
15
|
+
docker buildx bake -f bake.yml --set '*.output=type=docker' --sbom=false --provenance=false --metadata-file /tmp/bake-metadata.json; \
|
|
16
|
+
if [ \"${CI_BUILD_TARGET:-}\" = tests ]; then \
|
|
17
|
+
docker compose -f bake.yml down --remove-orphans; \
|
|
18
|
+
docker compose -f bake.yml up --force-recreate --no-build --pull never --abort-on-container-failure; \
|
|
19
|
+
fi; \
|
|
20
|
+
trivy-runner -f bake.yml --metadata-file /tmp/bake-metadata.json -- --severity HIGH,CRITICAL --ignore-unfixed --table-mode detailed; \
|
|
21
|
+
[ -z \"${CI_SKIP_PUSH:-}\" ] || exit 0; \
|
|
22
|
+
docker compose -f bake.yml push;\
|
|
17
23
|
"]
|
|
@@ -1,4 +1,6 @@
|
|
|
1
1
|
require 'rspec/core/rake_task'
|
|
2
|
+
require 'json'
|
|
3
|
+
require 'open3'
|
|
2
4
|
|
|
3
5
|
RSpec::Core::RakeTask.new(:spec)
|
|
4
6
|
|
|
@@ -12,3 +14,37 @@ task :coverage do
|
|
|
12
14
|
ENV['COVERAGE'] = 'true'
|
|
13
15
|
Rake::Task[:spec].invoke
|
|
14
16
|
end
|
|
17
|
+
|
|
18
|
+
desc "Build and scan all Compose services with Trivy (default: deploy and tests; optional target: deploy or tests)"
|
|
19
|
+
task :trivy, [:target] do |_, args|
|
|
20
|
+
targets = args[:target] ? [args[:target]] : %w[deploy tests]
|
|
21
|
+
abort "Trivy target must be deploy or tests" unless (targets - %w[deploy tests]).empty?
|
|
22
|
+
|
|
23
|
+
root = File.expand_path('..', __dir__)
|
|
24
|
+
scanner = ENV.fetch('TRIVY_IMAGE', 'aquasec/trivy:latest')
|
|
25
|
+
|
|
26
|
+
Dir.chdir(File.join(root, 'docker')) do
|
|
27
|
+
bake = %w[docker buildx bake --file docker-compose.yml]
|
|
28
|
+
config, status = Open3.capture2(*bake, '--print')
|
|
29
|
+
abort "Could not read Compose build configuration" unless status.success?
|
|
30
|
+
services = JSON.parse(config).fetch('target', {}).keys
|
|
31
|
+
abort "No buildable services found in docker-compose.yml" if services.empty?
|
|
32
|
+
sh 'docker', 'pull', scanner
|
|
33
|
+
|
|
34
|
+
targets.each do |target|
|
|
35
|
+
images = services.to_h { |service| [service, "local/#{service.downcase}:trivy-#{target}"] }
|
|
36
|
+
tags = images.flat_map { |service, image| ['--set', "#{service}.tags=#{image}"] }
|
|
37
|
+
sh(*bake, '--pull', '--allow', "fs.read=#{root}",
|
|
38
|
+
'--set', '*.output=type=docker', '--set', "*.target=#{target}", *tags, *services)
|
|
39
|
+
|
|
40
|
+
images.each_value do |image|
|
|
41
|
+
sh 'docker', 'run', '--rm',
|
|
42
|
+
'--volume', '/var/run/docker.sock:/var/run/docker.sock',
|
|
43
|
+
'--volume', 'trivy-cache:/root/.cache/trivy',
|
|
44
|
+
scanner, 'image', '--image-src', 'docker', '--scanners', 'vuln',
|
|
45
|
+
'--severity', 'HIGH,CRITICAL', '--ignore-unfixed', '--exit-code', '1',
|
|
46
|
+
'--table-mode', 'detailed', image
|
|
47
|
+
end
|
|
48
|
+
end
|
|
49
|
+
end
|
|
50
|
+
end
|