Skip to content

Commit 993856b

Browse files
Krusty93Krusty93
authored
feat: Refactor Dockerfile to better support new DevOps scenarios with Container App Jobs (#18)
1 parent f8ab1c6 commit 993856b

8 files changed

+279
-219
lines changed

‎.dockerignore

+118
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
**/.dockerignore
2+
**/.git
3+
apps/onboarding-ms/.idea/.gitignore
4+
**/bin
5+
**/docker-compose*
6+
**/Dockerfile*
7+
**/node_modules
8+
**/npm-debug.log
9+
**/obj
10+
**/secrets.dev.yaml
11+
**/values.dev.yaml
12+
LICENSE
13+
README.md
14+
15+
**/.idea
16+
.idea
17+
**/.mvn
18+
.mvn
19+
20+
**/target
21+
22+
# Created by .ignore support plugin (hsz.mobi)
23+
### Maven template
24+
target/
25+
pom.xml.tag
26+
pom.xml.releaseBackup
27+
pom.xml.versionsBackup
28+
pom.xml.next
29+
release.properties
30+
dependency-reduced-pom.xml
31+
buildNumber.properties
32+
.mvn/timing.properties
33+
.mvn/wrapper/maven-wrapper.jar
34+
### Java template
35+
# Compiled class file
36+
*.class
37+
38+
# Log file
39+
*.log
40+
41+
# BlueJ files
42+
*.ctxt
43+
44+
# Mobile Tools for Java (J2ME)
45+
.mtj.tmp/
46+
47+
# Package Files #
48+
*.jar
49+
*.war
50+
*.nar
51+
*.ear
52+
*.zip
53+
*.tar.gz
54+
*.rar
55+
56+
# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
57+
hs_err_pid*
58+
### JetBrains template
59+
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and WebStorm
60+
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
61+
62+
# User-specific stuff
63+
.idea/**/workspace.xml
64+
.idea/**/tasks.xml
65+
.idea/**/usage.statistics.xml
66+
.idea/**/dictionaries
67+
.idea/**/shelf
68+
69+
# Sensitive or high-churn files
70+
.idea/**/dataSources/
71+
.idea/**/dataSources.ids
72+
.idea/**/dataSources.local.xml
73+
.idea/**/sqlDataSources.xml
74+
.idea/**/dynamic.xml
75+
.idea/**/uiDesigner.xml
76+
.idea/**/dbnavigator.xml
77+
78+
# Gradle
79+
.idea/**/gradle.xml
80+
.idea/**/libraries
81+
82+
# Gradle and Maven with auto-import
83+
# When using Gradle or Maven with auto-import, you should exclude module files,
84+
# since they will be recreated, and may cause churn. Uncomment if using
85+
# auto-import.
86+
# .idea/modules.xml
87+
# .idea/*.iml
88+
# .idea/modules
89+
90+
# CMake
91+
cmake-build-*/
92+
93+
# Mongo Explorer plugin
94+
.idea/**/mongoSettings.xml
95+
96+
# File-based project format
97+
*.iws
98+
99+
# IntelliJ
100+
out/
101+
102+
# mpeltonen/sbt-idea plugin
103+
.idea_modules/
104+
105+
# JIRA plugin
106+
atlassian-ide-plugin.xml
107+
108+
# Cursive Clojure plugin
109+
.idea/replstate.xml
110+
111+
# Crashlytics plugin (for Android Studio and IntelliJ)
112+
com_crashlytics_export_strings.xml
113+
crashlytics.properties
114+
crashlytics-build.properties
115+
fabric.properties
116+
117+
# Editor-based Rest Client
118+
.idea/httpRequests

‎.github/workflows/beta-docker-branch.yml

+33-15
Original file line numberDiff line numberDiff line change
@@ -2,46 +2,64 @@ name: Beta docker on dev branch
22

33
on:
44
push:
5-
# Sequence of patterns matched against refs/heads
65
branches-ignore:
76
- 'main'
87
paths-ignore:
98
- 'CODEOWNERS'
109
- '**.md'
1110
- '.**'
1211

12+
env:
13+
REGISTRY: ghcr.io
14+
IMAGE_NAME: ${{ github.repository }}
15+
1316
jobs:
1417
release:
1518
name: Beta docker on dev branch
1619
runs-on: ubuntu-22.04
1720

1821
steps:
22+
1923
- name: Checkout
2024
id: checkout
21-
# from https://github.com/actions/checkout/commits/main
22-
uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
25+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
2326
with:
2427
persist-credentials: false
2528
fetch-depth: 0
2629

30+
- name: Setup Docker buildx
31+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
32+
2733
- name: Log in to the Container registry
28-
id: docker_login
29-
# from https://github.com/docker/login-action/commits/master
30-
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
34+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
3135
with:
32-
registry: ghcr.io
36+
registry: ${{ env.REGISTRY }}
3337
username: ${{ github.actor }}
3438
password: ${{ secrets.GITHUB_TOKEN }}
3539

40+
- name: Docker meta
41+
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
42+
id: meta
43+
with:
44+
images: |
45+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
46+
tags: |
47+
type=raw,value=beta-${{ github.ref_name }}
48+
labels:
49+
org.opencontainers.image.title=${{ env.IMAGE_NAME }}-beta
50+
org.opencontainers.image.description=GitHub self hosted runner
51+
org.opencontainers.image.authors=PagoPA
52+
org.opencontainers.image.url=github.com/pagopa/${{ github.repository }}
53+
org.opencontainers.image.source=https://github.com/pagopa/${{ github.repository }}
54+
3655
- name: Build and push Docker image
37-
id: docker_build_push
38-
# from https://github.com/docker/build-push-action/commits/master
39-
uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5
56+
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
4057
with:
4158
context: .
4259
push: true
43-
tags: |
44-
ghcr.io/${{ github.repository }}:beta-${{ github.ref_name }}
45-
labels: |
46-
maintainer=https://pagopa.it
47-
org.opencontainers.image.source=https://github.com/${{ github.repository }}
60+
tags: ${{ steps.meta.outputs.tags }}
61+
labels: ${{ steps.meta.outputs.labels }}
62+
file: Dockerfile
63+
cache-from: type=gha
64+
cache-to: type=gha,mode=min
65+
platforms: linux/amd64,linux/arm64

‎.github/workflows/release.yml

+31-15
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
name: Release
22

33
on:
4-
# Trigger the workflow on push on the main branch
54
push:
65
branches:
76
- main
@@ -10,23 +9,26 @@ on:
109
- '**.md'
1110
- '.**'
1211

12+
env:
13+
REGISTRY: ghcr.io
14+
IMAGE_NAME: ${{ github.repository }}
15+
1316
jobs:
1417
release:
1518
name: Release
1619
runs-on: ubuntu-22.04
1720

1821
steps:
22+
1923
- name: Checkout
2024
id: checkout
21-
# from https://github.com/actions/checkout/commits/main
22-
uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
25+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
2326
with:
2427
persist-credentials: false
2528
fetch-depth: 0
2629

2730
- name: Release
2831
id: release
29-
# from https://github.com/cycjimmy/semantic-release-action/commits/main
3032
uses: cycjimmy/semantic-release-action@bdd914ff2423e2792c73475f11e8da603182f32d
3133
with:
3234
semantic_version: 18.0.0
@@ -39,24 +41,38 @@ jobs:
3941
- name: Log in to the Container registry
4042
id: docker_login
4143
if: steps.release.outputs.new_release_published == 'true'
42-
# from https://github.com/docker/login-action/commits/master
43-
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
44+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
4445
with:
45-
registry: ghcr.io
46+
registry: ${{ env.REGISTRY }}
4647
username: ${{ github.actor }}
4748
password: ${{ secrets.GITHUB_TOKEN }}
4849

50+
- name: Docker meta
51+
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
52+
id: meta
53+
with:
54+
images: |
55+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
56+
tags: |
57+
type=raw,value=latest
58+
type=raw,value=v${{ steps.release.outputs.new_release_version }}
59+
labels:
60+
org.opencontainers.image.title=${{ env.IMAGE_NAME }}
61+
org.opencontainers.image.description=GitHub self hosted runner
62+
org.opencontainers.image.authors=PagoPA
63+
org.opencontainers.image.url=github.com/PagoPA/${{ github.repository }}
64+
org.opencontainers.image.source=https://github.com/${{ github.repository }}
65+
4966
- name: Build and push Docker image
5067
id: docker_build_push
5168
if: steps.release.outputs.new_release_published == 'true'
52-
# from https://github.com/docker/build-push-action/commits/master
53-
uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5
69+
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
5470
with:
5571
context: .
5672
push: true
57-
tags: |
58-
ghcr.io/${{ github.repository }}:latest
59-
ghcr.io/${{ github.repository }}:v${{ steps.release.outputs.new_release_version }}
60-
labels: |
61-
maintainer=https://pagopa.it
62-
org.opencontainers.image.source=https://github.com/${{ github.repository }}
73+
tags: ${{ steps.meta.outputs.tags }}
74+
labels: ${{ steps.meta.outputs.labels }}
75+
file: Dockerfile
76+
cache-from: type=gha
77+
cache-to: type=gha,mode=min
78+
platforms: linux/amd64,linux/arm64

‎.github/workflows/trivy.yml

+34-21
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,65 @@
1-
# This workflow uses actions that are not certified by GitHub.
2-
# They are provided by a third-party and are governed by
3-
# separate terms of service, privacy policy, and support
4-
# documentation.
5-
61
name: Docker security scan
72

83
on:
94
push:
105
branches: [ "main", "master" ]
116
pull_request:
12-
# The branches below must be a subset of the branches above
137
branches: [ "main", "master" ]
148
schedule:
159
- cron: '00 07 * * *'
1610

17-
permissions:
18-
contents: read
11+
env:
12+
REGISTRY: ghcr.io
13+
IMAGE_NAME: ${{ github.repository }}
1914

2015
jobs:
2116
build:
17+
name: Build
18+
runs-on: ubuntu-22.04
2219
permissions:
2320
contents: read # for actions/checkout to fetch code
2421
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
2522
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
26-
name: Build
27-
runs-on: ubuntu-22.04
23+
2824
steps:
25+
2926
- name: Checkout code
30-
# from https://github.com/actions/checkout/commits/main
3127
uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
3228

33-
- name: Build an image from Dockerfile
34-
run: |
35-
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
29+
- name: Setup Docker buildx
30+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
31+
32+
- name: Docker meta
33+
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
34+
id: meta
35+
with:
36+
images: |
37+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
38+
tags: |
39+
type=sha,enable=true,format=long
40+
41+
- name: Build Docker image
42+
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
43+
with:
44+
context: .
45+
load: true
46+
push: false
47+
tags: ${{ steps.meta.outputs.tags }}
48+
file: Dockerfile
49+
cache-from: type=gha
50+
cache-to: type=gha,mode=min
51+
platforms: linux/amd64
3652

3753
- name: Run Trivy vulnerability scanner
38-
# from https://github.com/aquasecurity/trivy-action/commits/master
39-
uses: aquasecurity/trivy-action@d63413b0a4a4482237085319f7f4a1ce99a8f2ac
54+
uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef # v0.17.0
4055
with:
41-
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
42-
format: 'template'
43-
template: '@/contrib/sarif.tpl'
56+
image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}'
57+
format: 'sarif'
4458
output: 'trivy-results.sarif'
4559
severity: 'CRITICAL,HIGH'
4660
timeout: '10m0s'
4761

4862
- name: Upload Trivy scan results to GitHub Security tab
49-
# from https://github.com/github/codeql-action/commits/main
50-
uses: github/codeql-action/upload-sarif@f0a12816612c7306b485a22cb164feb43c6df818
63+
uses: github/codeql-action/upload-sarif@592977e6ae857384aa79bb31e7a1d62d63449ec5 # v2.16.3
5164
with:
5265
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)