docker image hardening and one dockerfile for all services

.dockerignore

@@ -1,4 +1,13 @@
+.github
+.git
+.idea/
+.vscode/
 deploy/
+cicd/
 artifacts/
-.github
-.git
+*.md
+*.sh
+.dockerignore
+.gitignore
+**/Dockerfile
+**/docker-compose.yaml

.github/workflows/build.yaml

@@ -1,110 +1,25 @@
-name: Build
-on:   
+name: Build Service
+on:
   workflow_call:
     inputs:
-      image:
-        required: true
-        type: string
       path:
+        description: 'Path of the service'
         required: true
         type: string
 jobs:
   build:
-    name: Build
+    name: Build ${{ inputs.path }}
     runs-on: ubuntu-latest
     steps:
-
-    - name: Checkout
-      uses: actions/checkout@master
-
-    - uses: actions/setup-go@v3
-      name: go-cache
-      with:
-        go-version: '1.21'
-        check-latest: false
-        cache: true
-
-    - name: Build
-      env:
-        GOOS: linux
-        CGO_ENABLED: 0
-      run: go build -v -o app "${{ inputs.path }}"
-
-    - name: Build Release
-      if: |
-        github.event_name == 'push' && (
-          startsWith(github.event.ref, 'refs/tags/')
-          || endsWith(github.event.ref, '/master')
-        )
-      run: docker build -t hobbyfarm/"${{ inputs.image }}":${GIT_COMMIT_SHORT_HASH:-dev} -f cicd/Dockerfile .
-
-    - name: Compute Docker Tag
-      if: |
-        github.event_name == 'push' && (
-          startsWith(github.event.ref, 'refs/tags/')
-          || endsWith(github.event.ref, '/master')
-        )
-      id: compute_docker_tag
-      run: |
-        tag=${GITHUB_REF#refs/tags/}
-        branch=${GITHUB_REF#refs/heads/}
-        if [ "$tag" != "$GITHUB_REF" ]; then
-          tag=$(echo "$tag" | sed -e 's/[^a-zA-Z0-9\-\.]/-/g')
-          echo ::set-output name=DOCKER_TAG::${tag}
-        elif [ "$branch" != "$GITHUB_REF" ]; then
-          branch=$(echo "$branch" | sed -e 's/[^a-zA-Z0-9\-\.]/-/g')
-          echo ::set-output name=DOCKER_TAG::${branch}
-        else
-          echo "unable to determine docker tag" >&2
-          exit 1
-        fi
-
-    - name: Docker Login
-      if: |
-        github.event_name == 'push' && (
-          startsWith(github.event.ref, 'refs/tags/')
-          || endsWith(github.event.ref, '/master')
-        )
-      run: |
-        echo "${{ secrets.DOCKER_HUB_PASSWORD }}" \
-          | docker login -u "${{ secrets.DOCKER_HUB_USER }}" --password-stdin
-
-    - name: Docker Tag
-      if: |
-        github.event_name == 'push' && (
-          startsWith(github.event.ref, 'refs/tags/')
-          || endsWith(github.event.ref, '/master')
-        )
-      run: |
-        docker tag \
-          hobbyfarm/"${{ inputs.image }}":${GIT_COMMIT_SHORT_HASH:-dev} \
-          hobbyfarm/"${{ inputs.image }}":"${{ steps.compute_docker_tag.outputs.DOCKER_TAG }}"
 
-    - name: Docker Push
-      if: |
-        github.event_name == 'push' && (
-          startsWith(github.event.ref, 'refs/tags/')
-          || endsWith(github.event.ref, '/master')
-        )
-      run: |
-        docker push \
-          hobbyfarm/"${{ inputs.image }}":"${{ steps.compute_docker_tag.outputs.DOCKER_TAG }}"
+      - name: Checkout
+        uses: actions/checkout@v4
 
-    - name: Docker Tag Latest
-      if: |
-        github.event_name == 'push' && (
-          startsWith(github.event.ref, 'refs/tags/')
-        )
-      run: |
-        docker tag \
-          hobbyfarm/"${{ inputs.image }}":${GIT_COMMIT_SHORT_HASH:-dev} \
-          hobbyfarm/"${{ inputs.image }}":latest
+      - name: Setup go
+        # caching is enabled by default since setup-go@v4
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.23.6'
 
-    - name: Docker Push Latest
-      if: |
-        github.event_name == 'push' && (
-          startsWith(github.event.ref, 'refs/tags/')
-        )
-      run: |
-        docker push \
-          hobbyfarm/"${{ inputs.image }}":latest
+      - name: Build
+        run: go build -ldflags="-s -w" -v -o app "${{ inputs.path }}"

.github/workflows/main.yaml → .github/workflows/pr.yaml

@@ -1,135 +1,113 @@
-name: Main
-on: [push, pull_request]
+name: Pull Request
+on: [pull_request]
 jobs:
   build-gargantua:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./
-      image: gargantua
     secrets: inherit
   build-accesscode-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/accesscodesvc
-      image: accesscode-service
     secrets: inherit
   build-authn-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/authnsvc
-      image: authn-service
     secrets: inherit
   build-authr-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/authrsvc
-      image: authr-service
     secrets: inherit
   build-conversion-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/conversionsvc
-      image: conversion-service
     secrets: inherit
   build-cost-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/costsvc
-      image: cost-service
     secrets: inherit
   build-course-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/coursesvc
-      image: course-service
     secrets: inherit
   build-dbconfig-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/dbconfigsvc
-      image: dbconfig-service
     secrets: inherit
   build-environment-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/environmentsvc
-      image: environment-service
     secrets: inherit
   build-progress-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/progresssvc
-      image: progress-service
     secrets: inherit
   build-rbac-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/rbacsvc
-      image: rbac-service
     secrets: inherit
   build-scenario-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/scenariosvc
-      image: scenario-service
     secrets: inherit
   build-scheduledevent-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/scheduledeventsvc
-      image: scheduledevent-service
     secrets: inherit
   build-session-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/sessionsvc
-      image: session-service
     secrets: inherit
   build-setting-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/settingsvc
-      image: setting-service
     secrets: inherit
   build-terraform-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/terraformsvc
-      image: terraform-service
     secrets: inherit
   build-user-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/usersvc
-      image: user-service
     secrets: inherit
   build-vmclaim-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/vmclaimsvc
-      image: vmclaim-service
     secrets: inherit
   build-vmset-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/vmsetsvc
-      image: vmset-service
     secrets: inherit
   build-vm-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/vmsvc
-      image: vm-service
     secrets: inherit
   build-vmtemplate-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/vmtemplatesvc
-      image: vmtemplate-service
     secrets: inherit
   build-score-service:
     uses: ./.github/workflows/build.yaml
     with:
       path: ./v3/services/scoresvc
-      image: score-service
     secrets: inherit