Dockerfile #110

abhishekagrawal-atlan · 2025-11-13T04:04:24Z

Changelog

to be added

Additional context (e.g. screenshots, logs, links)

to be added

Checklist

Additional tests added
All CI checks passed
Relevant documentation updated

github-actions · 2025-11-13T04:05:20Z

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
391	384	98%	0%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 7702c0b by action🐍

github-actions · 2025-11-13T04:05:25Z

📦 Trivy Vulnerability Scan Results

Schema Version	Created At	Artifact	Type
2	2026-01-06T11:59:50.5173711Z	.	filesystem

Report Summary

Target	Type	Vulnerabilities	`.`	filesystem	✅ None found

Scan Result Details

✅ No vulnerabilities found during the scan for ..

github-actions · 2025-11-13T04:05:26Z

📦 Trivy Secret Scan Results

Schema Version	Created At	Artifact	Type
2	2026-01-06T12:00:04.925444235Z	.	filesystem

Report Summary

Target	Type	Secrets	`.`	filesystem	✅ None found

Scan Result Details

✅ No secrets found during the scan for ..

.github/workflows/build-image.yaml

.github/workflows/verify-snyk-status.yaml

.github/workflows/build-image.yaml

+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.app }}
+      cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
+    timeout-minutes: 20
+    strategy:
+      matrix:
+        app:
+          - quickstart/ai_giphy
+          - quickstart/giphy
+          - quickstart/hello_world
+          - quickstart/polyglot
+          - connectors/mysql
+          - connectors/anaplan
+          - templates/generic
+
+    steps:
+      # Checkout current repo (your app)
+      - uses: actions/[email protected]
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.ORG_PAT_GITHUB }}
+
+      # Checkout the private atlanhq/.github repo to a folder
+      - name: Checkout private action repo
+        uses: actions/checkout@v4
+        with:
+          repository: atlanhq/.github
+          token: ${{ secrets.ORG_PAT_GITHUB }}
+          path: private_github
+
+      - name: Get branch name
+        run: echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
+        id: get_branch
+
+      - run: echo "REPOSITORY_NAME=`echo "$GITHUB_REPOSITORY" | awk -F / '{print $2}' | sed -e "s/:refs//"`" >> $GITHUB_ENV
+        shell: bash
+
+      - name: Get version tag
+        run: echo "version=$(echo `git ls-remote https://${{ secrets.ORG_PAT_GITHUB }}@github.com/atlanhq/${REPOSITORY_NAME}.git ${{ steps.get_branch.outputs.branch }} | awk '{ print $1}' | cut -c1-7`)abcd" >> $GITHUB_OUTPUT
+        id: get_version
+
+      - name: Lowercase branch name
+        run: echo "lowercase_branch=$(echo '${{ steps.get_branch.outputs.branch }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+        id: get_lowercase_branch
+
+      - name: Normalize app name for image tags
+        run: echo "app_name=$(echo '${{ matrix.app }}' | tr '/' '-')" >> $GITHUB_OUTPUT
+        id: get_app_name
+
+      - name: Set up Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
+
+      - name: Login to GitHub Registry
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+        with:
+          registry: ghcr.io
+          username: $GITHUB_ACTOR
+          password: ${{ secrets.ORG_PAT_GITHUB }}
+
+      - name: Build and push docker image to GHCR
+        id: ghcr_docker_build
+        uses: ./private_github/.github/actions/secure-build-push-apps
+        with:
+          branch: ${{ github.ref_name }}
+          snyk-token: ${{ secrets.SNYK_TOKEN_BU_APPS }}
+          context: ./${{ matrix.app }}
+          file: ./${{ matrix.app }}/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ghcr.io/atlanhq/${{ github.event.repository.name }}-${{ steps.get_app_name.outputs.app_name }}-${{ steps.get_lowercase_branch.outputs.lowercase_branch }}:latest
+            ghcr.io/atlanhq/${{ github.event.repository.name }}-${{ steps.get_app_name.outputs.app_name }}-${{ steps.get_lowercase_branch.outputs.lowercase_branch }}:${{ steps.get_version.outputs.version }}
+          build-args: |
+            ACCESS_TOKEN_USR=$GITHUB_ACTOR
+            ACCESS_TOKEN_PWD=${{ secrets.ORG_PAT_GITHUB }}
+        env:
+          DOCKER_CLIENT_TIMEOUT: 600
+          COMPOSE_HTTP_TIMEOUT: 600
+
+      # Login to Docker Hub
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: atlanhq
+          password: ${{ secrets.DOCKER_HUB_PAT_RW }}
+
+      - name: Build and push docker image to Docker Hub
+        id: docker_build
+        uses: ./private_github/.github/actions/secure-build-push-apps
+        with:
+          branch: ${{ github.ref_name }}
+          snyk-token: ${{ secrets.SNYK_TOKEN_BU_APPS }}
+          context: ./${{ matrix.app }}
+          file: ./${{ matrix.app }}/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            registry-1.docker.io/atlanhq/${{ github.event.repository.name }}-${{ steps.get_app_name.outputs.app_name }}:${{ steps.get_branch.outputs.branch }}-${{ steps.get_version.outputs.version }}
+            registry-1.docker.io/atlanhq/${{ github.event.repository.name }}-${{ steps.get_app_name.outputs.app_name }}:${{ steps.get_branch.outputs.branch }}-latest
+        env:
+          DOCKER_CLIENT_TIMEOUT: 300
+          COMPOSE_HTTP_TIMEOUT: 300


…erfile

- lack of permissions on the token to upload the image. #42 exporting to image #42 pushing layers 0.8s done #42 ERROR: failed to push registry-1.docker.io/atlanhq/atlan-sample-apps-utilities-workflows_observability:dockerfile-b8daba8abcd: failed to authorize: failed to fetch oauth token: unexpected status from GET request to https://auth.docker.io/token?scope=repository%3Aatlanhq%2Fatlan-sample-apps-utilities-workflows_observability%3Apull%2Cpush&service=registry.docker.io: 401 Unauthorized: access token has insufficient scopes ------ > exporting to image: ------ ERROR: failed to build: failed to solve: failed to fetch oauth token: unexpected status from GET request to https://auth.docker.io/token?scope=repository%3Aatlanhq%2Fatlan-sample-apps-utilities-workflows_observability%3Apull%2Cpush&service=registry.docker.io: 401 Unauthorized: access token has insufficient scopes Reference Check build summary support Error: buildx failed with: ERROR: failed to build: failed to solve: failed to fetch oauth token: unexpected status from GET request to https://auth.docker.io/token?scope=repository%3Aatlanhq%2Fatlan-sample-apps-utilities-workflows_observability%3Apull%2Cpush&service=registry.docker.io: 401 Unauthorized: access token has insufficient scopes

Copilot

Pull request overview

This PR adds Dockerfiles for multiple applications and establishes comprehensive CI/CD workflows including security scanning with Snyk and Trivy. The changes standardize containerization across quickstart examples, connectors, and utilities while introducing automated security checks.

Adds standardized Dockerfiles across 9 applications using Chainguard base images with Dapr integration
Implements GitHub Actions workflows for pre-commit checks, container scanning (Snyk/Trivy), and automated image builds
Removes uv.lock from .gitignore for the polyglot quickstart

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 35 comments.

Show a summary per file

File	Description
utilities/workflows_observability/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
utilities/freshness_monitor/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
utilities/asset_descriptor_reminder/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
templates/generic/Dockerfile	Refactored to use application-sdk-chainguard-image base and Dapr 1.16.2
quickstart/polyglot/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
quickstart/polyglot/.gitignore	Removed uv.lock exclusion to track dependency locks
quickstart/hello_world/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
quickstart/giphy/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
quickstart/ai_giphy/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
connectors/mysql/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
connectors/anaplan/Dockerfile	New Dockerfile with Python, uv, and Dapr 1.16.x setup
.github/workflows/verify-snyk-status.yaml	Workflow to verify Snyk PR check status
.github/workflows/trivy-container.yaml	Reusable workflow for Trivy container scanning
.github/workflows/snyk-container-scan.yaml	Workflow for Snyk container scanning with Slack notifications
.github/workflows/schedule.yaml	Scheduled workflow for stale PR cleanup and Trivy scans
.github/workflows/docstring-coverage.yaml	Workflow to check docstring coverage on PRs
.github/workflows/commits.yaml	Workflow to validate conventional commit format
.github/workflows/checks.yaml	Pre-commit checks workflow with app discovery
.github/workflows/build-image.yaml	Multi-app Docker image build and push workflow
.github/actions/secure_build_push_apps/action.yaml	Composite action for building, scanning, and pushing Docker images with Snyk/Trivy

Comments suppressed due to low confidence (10)

utilities/workflows_observability/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

quickstart/polyglot/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

connectors/anaplan/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

utilities/asset_descriptor_reminder/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

templates/generic/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.2

quickstart/hello_world/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

quickstart/ai_giphy/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

connectors/mysql/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

utilities/freshness_monitor/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

quickstart/giphy/Dockerfile:36

Security concern: Downloading and executing a script directly from the internet without verification. Consider pinning the script to a specific commit hash or adding checksum verification to prevent potential supply chain attacks.

RUN curl -fsSL https://raw.githubusercontent.com/dapr/cli/master/install/install.sh | DAPR_INSTALL_DIR="/usr/local/bin" /bin/bash -s 1.16.3

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

quickstart/giphy/Dockerfile

.github/workflows/schedule.yaml

quickstart/polyglot/Dockerfile

quickstart/hello_world/Dockerfile

.github/workflows/commits.yaml

utilities/freshness_monitor/Dockerfile

quickstart/hello_world/Dockerfile

connectors/mysql/Dockerfile

connectors/anaplan/Dockerfile

utilities/asset_descriptor_reminder/Dockerfile

- Typo in "SNYK_DOCKER_INTEGRATION_ID" gh secret

…o dockerfile

abhishekagrawal-atlan added 2 commits November 12, 2025 19:15

chore: migrating sample apps to app-sdk base image

df56d55

fix: using image which is uploaded to ghcr

92ec723

abhishekagrawal-atlan added 11 commits November 13, 2025 09:46

chore: adding pre-commit checks for all sample-apps

4486f56

fix: pre-commit checks

f629286

fix: pre-commit failures

86648cf

fix: pre-commit

930e3fb

adding commits.yaml and docstring-coverage.yaml

faa5a44

fix: optimising pre-commit to auto-discover the apps

91cdd01

fix: pre-commit

71bace7

fix: pre-commit

0f59831

fix: pre-commit

9e65387

chore: adding app build and push to ghcr step for each sample app

1e70f31

fix: build-image

59d254a

github-advanced-security bot found potential problems Nov 13, 2025

View reviewed changes

.github/workflows/build-image.yaml Fixed Show fixed Hide fixed

abhishekagrawal-atlan added 2 commits November 13, 2025 12:59

fix: build-image

1fe105e

fix: build-image action

b0cae5a

github-advanced-security bot found potential problems Nov 13, 2025

View reviewed changes

.github/workflows/build-image.yaml Fixed Show fixed Hide fixed

chore: added actions for snyk container scan + verify snyk status

7541014

github-advanced-security bot found potential problems Nov 13, 2025

View reviewed changes

.github/workflows/verify-snyk-status.yaml Outdated Show resolved Hide resolved

abhishekagrawal-atlan and others added 5 commits November 13, 2025 14:11

chore: added stale PR schedule + trivy container checks

4358506

Update build-image.yaml

f093e77

debug: fix docker push ci / cd

c6d52d7

fix: docker image-build for all sample apps

cab7533

fix: cancel issue during docker-build

b4091fc

github-advanced-security bot found potential problems Nov 14, 2025

View reviewed changes

abhishekagrawal-atlan added 2 commits December 3, 2025 16:45

Merge branch 'main' into dockerfile

01df11e

Merge branch 'main' of github.com:atlanhq/atlan-sample-apps into dock…

6c93cc4

…erfile

abhishekagrawal-atlan added 7 commits December 3, 2025 16:59

chore: adding Dockerfile for all the utility apps

d253805

chore: making generic app use chainguard image

6867a7a

chore: updated the base-image and added secure-build-push action

ce688f4

fix: build-image wf

dc3eba0

fix: Dockerfile

b8daba8

chore: adding uv.lock for polyglot app

9bb82ec

abhishekagrawal-atlan marked this pull request as ready for review December 15, 2025 13:39

abhishekagrawal-atlan requested review from AtMrun, firecast and inishchith as code owners December 15, 2025 13:39

Copilot AI review requested due to automatic review settings December 15, 2025 13:39

Copilot started reviewing on behalf of abhishekagrawal-atlan December 15, 2025 13:39 View session

Copilot AI reviewed Dec 15, 2025

View reviewed changes

abhishekagrawal-atlan added 9 commits December 16, 2025 08:39

chore: modifying snyk container scan function to scan all dockerfiles

3eea6c8

fix: pre-commit

d45fc54

Merge branch 'main' into dockerfile

12d2baf

fix: PR comments

c0c82b5

- Typo in "SNYK_DOCKER_INTEGRATION_ID" gh secret

Merge branch 'dockerfile' of github.com:atlanhq/atlan-sample-apps int…

2a1871c

…o dockerfile

chore: re-adding abcd to image tag based on redshift app

d5e605e

fix: pre-commit EOL

e3eb068

fix: pre-commit checks

9de565f

chore: optimising all the Dockerfiles wrt modified app-sdk

d3cdc82

vishnub-atlan previously approved these changes Dec 16, 2025

View reviewed changes

fix: added venv creation step for all dockerfiles

fe1098c

abhishekagrawal-atlan dismissed vishnub-atlan’s stale review via fe1098c December 18, 2025 13:01

abhishekagrawal-atlan and others added 4 commits December 23, 2025 09:32

fix: removing custom branch from build-image.yaml

bcda608

Adding docker file to sample app for reference

a0fc787

Adding docker file to sample app for reference

71cbdfa

Adding docker file to sample app for reference

7702c0b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dockerfile #110

Dockerfile #110

Uh oh!

abhishekagrawal-atlan commented Nov 13, 2025

Uh oh!

github-actions bot commented Nov 13, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 13, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 13, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Dockerfile #110

Are you sure you want to change the base?

Dockerfile #110

Uh oh!

Conversation

abhishekagrawal-atlan commented Nov 13, 2025

Changelog

Additional context (e.g. screenshots, logs, links)

Checklist

Uh oh!

github-actions bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

☂️ Python Coverage

Overall Coverage

New Files

Modified Files

Uh oh!

github-actions bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Trivy Vulnerability Scan Results

Report Summary

Scan Result Details

Uh oh!

github-actions bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Trivy Secret Scan Results

Report Summary

Scan Result Details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions bot commented Nov 13, 2025 •

edited

Loading

github-actions bot commented Nov 13, 2025 •

edited

Loading

github-actions bot commented Nov 13, 2025 •

edited

Loading