Skip to content

Commit 6d450ed

Browse files
m-Bilalm-Bilal
authored
Update dependencies (#87)
The version of `swagger-typescript-api` has been fixed to `13.0.16` because newer versions have issues, and the fixes haven't been released yet Also added a Github Action that will build and scan the docker image to ensure we don't ship vulnerable images ([commit link](4352bc5))
1 parent f1ca40b commit 6d450ed

File tree

14 files changed

+1529
-4038
lines changed

14 files changed

+1529
-4038
lines changed

‎.dockerignore

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
./node_modules/**
2+
./dist/**
3+
4+
# test files
5+
**/test-data/**
6+
./tests/**
7+
**/*.test.ts

‎.github/workflows/build.yaml

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
name: Build and Scan Docker Image
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'Dockerfile'
9+
- '.dockerignore'
10+
- 'package.json'
11+
- 'package-lock.json'
12+
- 'tsconfig.json'
13+
- '.github/workflows/build.yaml'
14+
15+
jobs:
16+
build-docker-image:
17+
runs-on: ubuntu-24.04
18+
outputs:
19+
image_tag: ${{ steps.vars.outputs.commit_hash }}
20+
tar_file: ${{ steps.vars.outputs.tar_file }}
21+
image_name: ${{ steps.vars.outputs.image_name }}
22+
steps:
23+
- name: Checkout repository
24+
uses: actions/checkout@v4
25+
26+
- name: Get Commit Hash
27+
id: vars
28+
run: |
29+
commit_hash=$(git rev-parse --short HEAD)
30+
tar_file="ndc-openapi-${commit_hash}.tar"
31+
image_name="ndc-openapi:${commit_hash}"
32+
33+
echo "commit_hash: $commit_hash"
34+
echo "tar_file: $tar_file"
35+
echo "image_name: $image_name"
36+
37+
echo "commit_hash=$commit_hash" >> $GITHUB_ENV
38+
echo "tar_file=$tar_file" >> $GITHUB_ENV
39+
echo "image_name=$image_name" >> $GITHUB_ENV
40+
echo "::set-output name=commit_hash::$commit_hash"
41+
echo "::set-output name=tar_file::$tar_file"
42+
echo "::set-output name=image_name::$image_name"
43+
44+
- name: Set up Docker Buildx
45+
uses: docker/setup-buildx-action@v3
46+
47+
- name: Build Docker image
48+
run: |
49+
docker build -t $image_name .
50+
51+
- name: Save Docker image as artifact
52+
run: |
53+
docker save -o $tar_file $image_name
54+
55+
- name: Upload Docker image artifact
56+
uses: actions/upload-artifact@v4
57+
with:
58+
name: ${{ env.tar_file }}
59+
path: ${{ env.tar_file }}
60+
retention-days: 1
61+
62+
scan-docker-image-with-gokakashi:
63+
needs: build-docker-image
64+
runs-on: ubuntu-latest
65+
steps:
66+
- name: Download Docker image artifact
67+
uses: actions/download-artifact@v4
68+
with:
69+
name: ${{ needs.build-docker-image.outputs.tar_file }}
70+
71+
- name: Load Docker image
72+
run: |
73+
docker load -i ${{ needs.build-docker-image.outputs.tar_file }}
74+
75+
- name: Scan docker image with gokakashi
76+
uses: shinobistack/[email protected]
77+
with:
78+
image: '${{ needs.build-docker-image.outputs.image_name }}'
79+
labels: agentKey=${{ github.run_id }}
80+
policy: ci-platform
81+
server: https://gokakashi-server.hasura-app.io
82+
token: ${{ secrets.GOKAKASHI_API_TOKEN }}
83+
cf_client_id: ${{ secrets.CF_ACCESS_CLIENT_ID }}
84+
cf_client_secret: ${{ secrets.CF_ACCESS_CLIENT_SECRET }}
85+
interval: 10
86+
retries: 8
87+
88+
scan-docker-image-with-trivy:
89+
needs: build-docker-image
90+
runs-on: ubuntu-latest
91+
steps:
92+
- name: Download Docker image artifact
93+
uses: actions/download-artifact@v4
94+
with:
95+
name: ${{ needs.build-docker-image.outputs.tar_file }}
96+
97+
- name: Load Docker image
98+
run: |
99+
docker load -i ${{ needs.build-docker-image.outputs.tar_file }}
100+
- name: Run Trivy vulnerability scan
101+
uses: aquasecurity/trivy-action@master
102+
with:
103+
image-ref: '${{ needs.build-docker-image.outputs.image_name }}'
104+
format: 'table'
105+
exit-code: 1
106+
severity: 'CRITICAL,HIGH'

‎Dockerfile

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,17 @@
1-
FROM node:20
1+
FROM node:20-alpine
2+
3+
# we need to update npm to update cross-spawn to a version higher than or equal to 7.0.6 to avoid a critical vulnerability
4+
RUN npm update -g npm
25

36
COPY ./ /app/
47
WORKDIR /app/
58

69
RUN npm install
7-
RUN npm run install-bin
10+
11+
# we use unsafe install because we have ignored all the test files to keep the image size small
12+
# the test files are not needed in the production image
13+
# therefore, please ensure that the tests are green before building the image
14+
RUN npm run install-bin-unsafe
815

916
RUN mkdir /etc/connector/
1017
WORKDIR /etc/connector/

‎changelog.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
## Unreleased
44

5+
- Update dependencies. Also update ndc-nodejs-lambda to `v1.12.0` ([#87](https://github.com/hasura/ndc-open-api-lambda/pull/87))
6+
57
## [[1.5.1](https://github.com/hasura/ndc-open-api-lambda/releases/tag/v1.5.1)] 2025-03-10
68

79
- Set `allowrelaxedtypes` annotation for every function (API) ([#85](https://github.com/hasura/ndc-open-api-lambda/pull/85))

‎connector-definition/.hasura-connector/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM ghcr.io/hasura/ndc-nodejs-lambda:v1.11.0
1+
FROM ghcr.io/hasura/ndc-nodejs-lambda:v1.12.0
22

33
COPY package-lock.json package.json api.ts /functions/
44

0 commit comments

Comments
 (0)