Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Integrate Static Code Analysis Tools #23

Closed
wants to merge 12 commits into from
Closed

Integrate Static Code Analysis Tools #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
d4a731f
Add CI linting and security scan
sbreker Apr 17, 2024
a22d4d4
Set Hadolint rule DL3003 to info severity
sbreker Apr 25, 2024
dfcdf09
Limit Hadolint scan to 1.1.21.2 Dockerfile
sbreker Apr 25, 2024
c886e6d
Limit Checkov scan to 1.1.21.2 Dockerfile
sbreker Apr 25, 2024
a7e2297
Set secure SHELL options before RUN
sbreker Apr 25, 2024
6ac220a
Add HEALTHCHECK to Dockerfile
sbreker Apr 25, 2024
31168a4
Skip rule DL3018, SC2086 for 'apk add $runDeps'
sbreker Apr 26, 2024
2a8e72d
Run wget with -q option
sbreker Apr 26, 2024
5c5f69a
Limit ShellCheck scan to 1.1.21.2 Dockerfile
sbreker Apr 26, 2024
285cc22
Skip rule DL3003
sbreker Apr 28, 2024
8fd491d
Ignore Hadolint rule DL3019 use '--no-cache'
sbreker Apr 28, 2024
2328231
Disable Hadolint rules
sbreker Apr 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
name: Lint and Security Check

on:
push:
pull_request:
branches:
- main

permissions: read-all

jobs:
shellcheck:
name: Lint Shell Scripts with ShellCheck
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v3

- name: Run ShellCheck
uses: ludeeus/action-shellcheck@master
with:
scandir: './1.1.21.2'

hadolint:
name: Lint Dockerfiles with Hadolint
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v3

- name: Run Hadolint with GitHub Action
uses: hadolint/hadolint-action@v3.1.0
with:
dockerfile: 1.1.21.2/Dockerfile
failure-threshold: warning
ignore: DL3018, DL3003

checkov:
name: Run Checkov for Dockerfile Security Analysis
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v3

- name: Run Checkov with GitHub Action
uses: bridgecrewio/checkov-action@master
with:
directory: 1.1.21.2/
quiet: false
14 changes: 10 additions & 4 deletions 1.1.21.2/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,13 @@
ENV GEARMAND_VERSION 1.1.21
ENV GEARMAND_SHA1 472d2a0019e69edefcd0c1ff57e9352982e6d3f5

SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]

RUN addgroup -S gearman && adduser -G gearman -S -D -H -s /bin/false -g "Gearman Server" gearman

RUN set -x \
&& apk add --no-cache --virtual .build-deps \
# Package list 'runDeps' is programmatically generated.
# hadolint ignore=SC2086, DL3019
RUN apk add --no-cache --virtual .build-deps \

Check failure on line 12 in 1.1.21.2/Dockerfile

View workflow job for this annotation

GitHub Actions / Lint Dockerfiles with Hadolint 

DL3003 warning: Use WORKDIR to switch to a directory

Check failure on line 12 in 1.1.21.2/Dockerfile

View workflow job for this annotation

GitHub Actions / Lint Dockerfiles with Hadolint 

DL3003 warning: Use WORKDIR to switch to a directory
wget \
tar \
ca-certificates \
Expand All @@ -20,7 +23,7 @@
hiredis-dev \
mariadb-dev \
libmemcached-dev \
&& wget -O gearmand.tar.gz "https://github.com/gearman/gearmand/releases/download/$GEARMAND_VERSION/gearmand-$GEARMAND_VERSION.tar.gz" \
&& wget -O gearmand.tar.gz -q "https://github.com/gearman/gearmand/releases/download/$GEARMAND_VERSION/gearmand-$GEARMAND_VERSION.tar.gz" \
&& echo "$GEARMAND_SHA1 gearmand.tar.gz" | sha1sum -c - \
&& mkdir -p /usr/src/gearmand \
&& tar -xzf gearmand.tar.gz -C /usr/src/gearmand --strip-components=1 \
Expand All @@ -44,13 +47,16 @@
scanelf --needed --nobanner --recursive /usr/local \
| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
| sort -u \
| xargs -r apk info --installed \
| xargs -r apk info --installed || true \
| sort -u \
)" \
&& apk add --virtual .gearmand-rundeps $runDeps \
&& apk del .build-deps \
&& /usr/local/sbin/gearmand --version

HEALTHCHECK --interval=5m --timeout=3s --retries=2 \
CMD test $(netstat -ltn | grep -c :$GEARMAND_LISTEN_PORT) -eq 1 || exit 1

COPY docker-entrypoint.sh /usr/local/bin/
RUN apk add --no-cache bash \
&& touch /etc/gearmand.conf && chown gearman:gearman /etc/gearmand.conf \
Expand Down
Loading