Initial commit

Author: mnaser

.github/workflows/ci.yaml

@@ -0,0 +1,22 @@
+name: ci
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  actions: read
+  contents: write
+  id-token: write
+  packages: write
+  security-events: write
+
+jobs:
+  image:
+    uses: vexxhost/github-actions/.github/workflows/image.yml@main
+    with:
+      image-ref: ghcr.io/${{ github.repository_owner }}/kubernetes-entrypoint
+      push: ${{ github.event_name == 'push' }}

.github/workflows/periodic.yaml

@@ -0,0 +1,17 @@
+name: periodic
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: vexxhost/github-actions/scan-image@main
+        with:
+          image-ref: ghcr.io/${{ github.repository_owner }}/kubernetes-entrypoint:edge

Dockerfile

@@ -0,0 +1,11 @@
+FROM golang:1.23.1 AS build
+# renovate: name=airship/kubernetes-entrypoint repo=https://opendev.org/airship/kubernetes-entrypoint.git branch=master
+ARG KUBERNETES_ENTRYPOINT_GIT_REF=cc2737be5285951ac08b32e76dfd375e1a0ab81f
+ADD https://opendev.org/airship/kubernetes-entrypoint.git#${KUBERNETES_ENTRYPOINT_GIT_REF} /src
+WORKDIR /src
+RUN CGO_ENABLED=0 GOOS=linux go build -o /main
+
+FROM scratch
+COPY --from=build /main /kubernetes-entrypoint
+USER 65534
+ENTRYPOINT ["/kubernetes-entrypoint"]

README.md

@@ -0,0 +1,14 @@
+# `docker-kubernetes-entrypoint`
+
+This is a build of the `kubernetes-entrypoint` component for Atmosphere
+which is built on top of `scratch`.
+
+- Security scanning via Trivy
+- Periodic vulnerability scanning via Trivy
+- Automatic dependency updates via Renovate
+
+The image is published to the following GitHub Container Registry:
+
+- `ghcr.io/vexxhost/kubernetes-entrypoint:edge`
+- `ghcr.io/vexxhost/kubernetes-entrypoint:edge-<timestamp>`
+- `ghcr.io/vexxhost/kubernetes-entrypoint:sha-<short-sha>`

renovate.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "docker:pinDigests",
+    "helpers:pinGitHubActionDigestsToSemver"
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["Dockerfile"],
+      "matchStrings": [
+        "# renovate: name=(?<depName>.+?) repo=(?<packageName>.+?) branch=(?<currentValue>.+?)\nARG .+?_GIT_REF=(?<currentDigest>.+?)\n"
+      ],
+      "datasourceTemplate": "git-refs"
+    }
+  ]
+}