Skip to content
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 10 additions & 9 deletions .github/workflows/build-pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -177,16 +177,17 @@ jobs:
- name: build frontend
run: yarn run build

- name: "Build Angular frontend image"
run: |
docker build . \
--file ci.dockerfile \
--tag prime-angular-frontend

- name: "Docker tag and push Angular frontend image"
run: |
docker tag prime-angular-frontend ${{secrets.OPENSHIFT_IMAGE_REPOSITORY}}/${{secrets.OPENSHIFT_LICENSE_PLATE}}-tools/prime-frontend:pr-${{steps.PR.outputs.number}}
docker push ${{secrets.OPENSHIFT_IMAGE_REPOSITORY}}/${{secrets.OPENSHIFT_LICENSE_PLATE}}-tools/prime-frontend:pr-${{steps.PR.outputs.number}}
#- name: "Build Angular frontend image"
#run: |
# docker build . \
# --file ci.dockerfile \
# --tag prime-angular-frontend

#- name: "Docker tag and push Angular frontend image"
#run: |
# docker tag prime-angular-frontend ${{secrets.OPENSHIFT_IMAGE_REPOSITORY}}/${{secrets.OPENSHIFT_LICENSE_PLATE}}-tools/prime-frontend:pr-${{steps.PR.outputs.number}}
# docker push ${{secrets.OPENSHIFT_IMAGE_REPOSITORY}}/${{secrets.OPENSHIFT_LICENSE_PLATE}}-tools/prime-frontend:pr-${{steps.PR.outputs.number}}

apply-oc-template:
runs-on: ubuntu-24.04
Expand Down
22 changes: 13 additions & 9 deletions document-manager/backend/openshift.dockerfile
Original file line number Diff line number Diff line change
@@ -1,15 +1,19 @@
FROM public.ecr.aws/bitnami/python:3.12.4

WORKDIR /opt/app-root/src

FROM python:3.12.4
SHELL ["/bin/bash","-c"]

# Install dependencies
RUN install_packages gcc libc6-dev libpq-dev libmagic-dev
RUN apt-get update -yqq && \

Check warning on line 5 in document-manager/backend/openshift.dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Merge this RUN instruction with the consecutive ones.

See more on https://sonarcloud.io/project/issues?id=bcgov_moh-prime&issues=AZ61E6_VFgy9ICN0KCuW&open=AZ61E6_VFgy9ICN0KCuW&pullRequest=2863
apt-get install -y gcc libc6-dev libpq-dev libmagic-dev && \

Check warning on line 6 in document-manager/backend/openshift.dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Sort these package names alphanumerically.

See more on https://sonarcloud.io/project/issues?id=bcgov_moh-prime&issues=AZ60ywi6_DMuGrKcji4i&open=AZ60ywi6_DMuGrKcji4i&pullRequest=2863

Check warning on line 6 in document-manager/backend/openshift.dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Make sure automatically installing recommended packages is safe here.

See more on https://sonarcloud.io/project/issues?id=bcgov_moh-prime&issues=AZ60ywi6_DMuGrKcji4h&open=AZ60ywi6_DMuGrKcji4h&pullRequest=2863

Check notice

Code scanning / SonarCloud

Recommended packages should not be automatically installed Low

Make sure automatically installing recommended packages is safe here. See more on SonarQube Cloud
Comment thread
bergomi02 marked this conversation as resolved.
Dismissed
rm -rf /var/lib/apt/lists/*

# Create working directory
RUN mkdir /app
WORKDIR /app

# Install the requirements
COPY ./requirements.txt .
RUN pip install wheel && \
pip install -r requirements.txt --src /opt/app-root/src
COPY requirements.txt .
RUN pip install --no-cache-dir wheel && \

Check warning on line 15 in document-manager/backend/openshift.dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Merge this RUN instruction with the consecutive ones.

See more on https://sonarcloud.io/project/issues?id=bcgov_moh-prime&issues=AZ60ywi6_DMuGrKcji4f&open=AZ60ywi6_DMuGrKcji4f&pullRequest=2863

Check warning on line 15 in document-manager/backend/openshift.dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is safe here.

See more on https://sonarcloud.io/project/issues?id=bcgov_moh-prime&issues=AZ61E6_VFgy9ICN0KCuX&open=AZ61E6_VFgy9ICN0KCuX&pullRequest=2863

Check warning on line 15 in document-manager/backend/openshift.dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive.

See more on https://sonarcloud.io/project/issues?id=bcgov_moh-prime&issues=AZ61E6_VFgy9ICN0KCuY&open=AZ61E6_VFgy9ICN0KCuY&pullRequest=2863

Check warning

Code scanning / SonarCloud

Python package manager scripts should not be executed during installation Medium

Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is safe here. See more on SonarQube Cloud

Check warning

Code scanning / SonarCloud

Python dependencies should be locked to verified versions Medium

Using dependencies without locking resolved versions is security-sensitive. See more on SonarQube Cloud
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
pip install -r requirements.txt

Check warning on line 16 in document-manager/backend/openshift.dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive.

See more on https://sonarcloud.io/project/issues?id=bcgov_moh-prime&issues=AZ61E6_VFgy9ICN0KCua&open=AZ61E6_VFgy9ICN0KCua&pullRequest=2863

Check warning on line 16 in document-manager/backend/openshift.dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is safe here.

See more on https://sonarcloud.io/project/issues?id=bcgov_moh-prime&issues=AZ61E6_VFgy9ICN0KCuZ&open=AZ61E6_VFgy9ICN0KCuZ&pullRequest=2863

Check warning

Code scanning / SonarCloud

Python dependencies should be locked to verified versions Medium

Using dependencies without locking resolved versions is security-sensitive. See more on SonarQube Cloud

Check warning

Code scanning / SonarCloud

Python package manager scripts should not be executed during installation Medium

Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is safe here. See more on SonarQube Cloud
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed

RUN apt-get purge -y --auto-remove gcc libc6-dev

Expand All @@ -19,4 +23,4 @@

# Run the server
EXPOSE 5001 9191
ENTRYPOINT /opt/app-root/src/app.sh backend
ENTRYPOINT ["./app.sh", "backend"]
2 changes: 1 addition & 1 deletion infrastructure/prime-app-ephemeral-template.yml
Original file line number Diff line number Diff line change
Expand Up @@ -867,7 +867,7 @@ objects:
command:
# Script force waits migration pod execution until PostgreSQL is verified to
# be open to query connections.
- /opt/app-root/src/app.sh
- /app/app.sh
args:
- migrate
containers:
Expand Down
7 changes: 4 additions & 3 deletions infrastructure/prime-app-template.yml
Original file line number Diff line number Diff line change
Expand Up @@ -881,12 +881,13 @@ objects:
- name: run-migrations
image: >-
image-registry.openshift-image-registry.svc:5000/${OC_LICENSE_PLATE}-tools/prime-document-manager:${IMAGE_TAG}
workingDir: /app
command:
# Script force waits migration pod execution until PostgreSQL is verified to
# be open to query connections.
- /opt/app-root/src/app.sh
args:
- migrate
- /bin/sh
- '-c'
- './init-backend.sh migrate'
env:
- name: CACHE_REDIS_HOST
value: ${SVC_NAME}-redis
Expand Down
Loading