mcp-context-forge/.github/workflows/docker-scan.yml at 90138da21adaa20a52988eec52f7816ce57b00f8 · IBM/mcp-context-forge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
# ===============================================================
# Docker Security Scan Workflow
# ===============================================================
#
# This workflow builds the container image locally and generates an SBOM
# artifact for review:
#   1. Build image locally (no push required)
#   2. Generate SBOM with Syft
#   3. Upload SBOM artifact
#
# Runs on both PRs and pushes to catch issues early.
#
# ===============================================================

name: Docker Security Scan

on:
  push:
    branches: ["main"]
    paths:
      - 'Containerfile'
      - 'Containerfile.lite'
      - 'crates/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'a2a-agents/go/a2a-echo-agent/**'
      - 'mcp-servers/python/python_sandbox_server/docker/**'
      - 'docker-compose.yml'
      - 'docker-compose-embedded.yml'
      - 'docker-compose-verbose-logging.yml'
      - 'mcpgateway/**'
      - 'plugins/**'
      - 'pyproject.toml'
      - '.github/workflows/docker-scan.yml'
  pull_request:
    types: [opened, synchronize, ready_for_review]
    branches: ["main"]
    paths:
      - 'Containerfile'
      - 'Containerfile.lite'
      - 'crates/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'a2a-agents/go/a2a-echo-agent/**'
      - 'mcp-servers/python/python_sandbox_server/docker/**'
      - 'docker-compose.yml'
      - 'docker-compose-embedded.yml'
      - 'docker-compose-verbose-logging.yml'
      - 'mcpgateway/**'
      - 'plugins/**'
      - 'pyproject.toml'
      - '.github/workflows/docker-scan.yml'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  IMAGE_NAME: mcp-context-forge-scan

jobs:
  container-smoke:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    name: Container Smoke (${{ matrix.name }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: main
            context: .
            file: Containerfile
            tag: mcp-context-forge-main-smoke:scan
          - name: a2a-echo-agent
            context: a2a-agents/go/a2a-echo-agent
            file: a2a-agents/go/a2a-echo-agent/Dockerfile
            tag: mcp-context-forge-a2a-echo-agent:scan
          - name: python-sandbox
            context: mcp-servers/python/python_sandbox_server
            file: mcp-servers/python/python_sandbox_server/docker/Dockerfile.sandbox
            tag: mcp-context-forge-python-sandbox:scan

    steps:
      - name: Checkout code
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Build container locally
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          platforms: linux/amd64
          push: false
          load: true
          tags: ${{ matrix.tag }}

  # ---------------------------------------------------------------
  # Build image and generate SBOM
  # ---------------------------------------------------------------
  scan:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    name: Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout code
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Build image locally
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: Containerfile.lite
          platforms: linux/amd64
          push: false
          load: true
          tags: ${{ env.IMAGE_NAME }}:scan
          cache-from: type=gha,scope=scan-build-amd64
          cache-to: type=gha,mode=max,scope=scan-build-amd64

      - name: Generate SBOM (Syft)
        run: |
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v "${PWD}:/work" \
            anchore/syft:v1.42.3 \
            "docker:${IMAGE_NAME}:scan" -o spdx-json=/work/sbom.spdx.json

      - name: Upload SBOM
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: sbom
          path: sbom.spdx.json
          retention-days: 30

  rust-enabled-build:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    name: Rust-enabled container smoke
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - name: Checkout code
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Build Rust-enabled image locally
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: Containerfile.lite
          platforms: linux/amd64
          push: false
          load: false
          build-args: |
            ENABLE_RUST=true
          cache-from: type=gha,scope=scan-build-rust-amd64
          cache-to: type=gha,mode=max,scope=scan-build-rust-amd64