Skip to content

Commit b4fd48d

Browse files
davidjeddydavidjeddy
authored
Merge pull request #63 from appwrite/clo-4095-cve-maintenance-01
Updated PHP, Swoole, Imagemagick, Add more CI scanning, ...
2 parents 7700869 + 2693847 commit b4fd48d

File tree

12 files changed

+508
-203
lines changed

12 files changed

+508
-203
lines changed

‎.dive-ci.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
rules:
2+
# If the efficiency is measured below X%, mark as failed.
3+
# Expressed as a ratio between 0-1.
4+
lowestEfficiency: 0.90
5+
6+
# If the amount of wasted space is at least X or larger than X, mark as failed.
7+
# Expressed in B, KB, MB, and GB.
8+
highestWastedBytes: 128MB
9+
10+
# If the amount of wasted space makes up for X% or more of the image, mark as failed.
11+
# Note: the base image layer is NOT included in the total image size.
12+
# Expressed as a ratio between 0-1; fails if the threshold is met or crossed.
13+
highestUserWastedPercent: 0.10

‎.dockerignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
.git*
2+
*.md
3+
*test*.*
4+
Dockerfile
5+
LICENSE
6+
trivy-*.json

‎.github/workflows/build-and-push.yml‎

Lines changed: 68 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,87 @@
1-
name: Build and Push to DockerHub
1+
name: Build and Push
22

3-
on:
3+
on:
4+
push:
45
release:
56
types: [published]
67

8+
permissions:
9+
contents: read
10+
711
env:
8-
REGISTRY: docker.io
912
IMAGE_NAME: appwrite/base
10-
TAG: ${{ github.event.release.tag_name }}
13+
REGISTRY: docker.io
1114

15+
# https://github.blog/changelog/2025-01-16-linux-arm64-hosted-runners-now-available-for-free-in-public-repositories-public-preview/
16+
# https://learn.arm.com/learning-paths/cross-platform/github-arm-runners/actions/
1217
jobs:
13-
build:
14-
runs-on: ubuntu-latest
18+
build_and_push:
19+
runs-on: ${{ matrix.os }}
20+
strategy:
21+
matrix:
22+
include:
23+
- os: ubuntu-24.04
24+
arch: amd64
25+
- os: ubuntu-24.04-arm
26+
arch: arm64
1527
steps:
1628
- name: Checkout the repo
17-
uses: actions/checkout@v3
29+
uses: actions/checkout@v6.0.2
1830

1931
- name: Login to DockerHub
20-
uses: docker/login-action@v2
32+
uses: docker/login-action@v4
2133
with:
2234
username: ${{ secrets.DOCKERHUB_USERNAME }}
2335
password: ${{ secrets.DOCKERHUB_TOKEN }}
2436

25-
- name: Set up QEMU
26-
uses: docker/setup-qemu-action@v2
37+
- name: Build an image from Dockerfile
38+
run: |
39+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-${{matrix.arch}} .
2740
28-
- name: Set up Docker Buildx
29-
uses: docker/setup-buildx-action@v2
41+
- name: Push an image
42+
run: |
43+
docker image push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-${{matrix.arch}}
3044
31-
- name: Build and push
32-
uses: docker/build-push-action@v4
45+
manifest_build_and_push_on_feature:
46+
if: github.ref != 'refs/heads/main'
47+
needs: build_and_push
48+
runs-on: ubuntu-24.04
49+
steps:
50+
- name: Login to DockerHub
51+
uses: docker/login-action@v4
3352
with:
34-
context: .
35-
platforms: linux/amd64,linux/arm64
36-
push: true
37-
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG }}
53+
username: ${{ secrets.DOCKERHUB_USERNAME }}
54+
password: ${{ secrets.DOCKERHUB_TOKEN }}
55+
56+
- name: Create manifest
57+
run: |
58+
docker manifest create \
59+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
60+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-amd64 \
61+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-arm64
62+
63+
- name: Push manifest
64+
run: |
65+
docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
66+
67+
manifest_build_and_push_on_main:
68+
if: github.ref == 'refs/heads/main'
69+
needs: build_and_push
70+
runs-on: ubuntu-24.04
71+
steps:
72+
- name: Login to DockerHub
73+
uses: docker/login-action@v4
74+
with:
75+
username: ${{ secrets.DOCKERHUB_USERNAME }}
76+
password: ${{ secrets.DOCKERHUB_TOKEN }}
77+
78+
- name: Create manifest
79+
run: |
80+
docker manifest create \
81+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }} \
82+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-amd64 \
83+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-arm64
84+
85+
- name: Push manifest
86+
run: |
87+
docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}

‎.github/workflows/dive.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Dive Test
2+
3+
on: push
4+
5+
permissions:
6+
contents: read
7+
8+
env:
9+
IMAGE_NAME: appwrite/base
10+
REGISTRY: docker.io
11+
12+
jobs:
13+
dive:
14+
runs-on: ubuntu-24.04
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v6.0.2
18+
19+
- name: Build an image from Dockerfile
20+
run: |
21+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
22+
23+
- name: Dive
24+
uses: yuichielectric/dive-action@0.0.4
25+
with:
26+
config-file: ${{ github.workspace }}/.dive-ci.yml
27+
image: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'

‎.github/workflows/structure-test.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# https://github.com/marketplace/actions/container-structure-test-action
2+
name: Container Structure Test
3+
4+
on: push
5+
6+
permissions:
7+
contents: read
8+
9+
env:
10+
IMAGE_NAME: appwrite/base
11+
REGISTRY: docker.io
12+
13+
jobs:
14+
structure_test:
15+
runs-on: ubuntu-24.04
16+
steps:
17+
- name: Checkout the repo
18+
uses: actions/checkout@v6.0.2
19+
20+
- name: Build an image from Dockerfile
21+
run: |
22+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
23+
24+
- name: Run container structure tests
25+
uses: plexsystems/container-structure-test-action@v0.1.0
26+
with:
27+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
28+
config: tests.yaml

‎.github/workflows/test.yml‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎.github/workflows/trivy.yml‎

Lines changed: 22 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
1-
# This workflow uses actions that are not certified by GitHub.
2-
# They are provided by a third-party and are governed by
3-
# separate terms of service, privacy policy, and support
4-
# documentation.
5-
6-
name: trivy
1+
# https://github.com/aquasecurity/trivy-action
2+
name: Trivy Scan
73

84
on:
95
push:
@@ -15,34 +11,35 @@ on:
1511
- cron: '43 11 * * 6'
1612

1713
permissions:
18-
contents: read
14+
contents: read # for actions/checkout to fetch code
15+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
16+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
17+
18+
env:
19+
IMAGE_NAME: appwrite/base
20+
REGISTRY: docker.io
1921

2022
jobs:
21-
build:
22-
permissions:
23-
contents: read # for actions/checkout to fetch code
24-
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
25-
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
26-
name: Build
27-
runs-on: ubuntu-latest
23+
scheduled_trivy:
24+
runs-on: ubuntu-24.04
2825
steps:
2926
- name: Checkout code
30-
uses: actions/checkout@v4
27+
uses: actions/checkout@v6.0.2
3128

3229
- name: Build an image from Dockerfile
3330
run: |
34-
docker build -t appwrite/docker-base:${{ github.sha }} .
31+
docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
3532
36-
- name: Run Trivy vulnerability scanner
37-
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
33+
- name: Run Trivy vulnerability scanner (sarif report)
34+
uses: aquasecurity/trivy-action@0.35.0
3835
with:
39-
image-ref: 'appwrite/docker-base:${{ github.sha }}'
40-
format: 'template'
41-
template: '@/contrib/sarif.tpl'
42-
output: 'trivy-results.sarif'
36+
format: 'sarif'
37+
image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
38+
output: 'trivy-image-results.sarif'
4339
severity: 'CRITICAL,HIGH'
4440

45-
- name: Upload Trivy scan results to GitHub Security tab
46-
uses: github/codeql-action/upload-sarif@v3
41+
# https://github.com/github/codeql-action/blob/main/upload-sarif/action.yml
42+
- name: Upload Trivy scan results
43+
uses: github/codeql-action/upload-sarif@v4
4744
with:
48-
sarif_file: 'trivy-results.sarif'
45+
sarif_file: '.'

‎CHANGES.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# CHANGELOG
2+
3+
## Version 1.1.0
4+
5+
### Add
6+
7+
* .dockerignore
8+
* .github/workflows/pr-scan.yml to scan all commit pushes for vulnerabilities
9+
* base_image and php_build_date to container labels
10+
* container image build action to publish image using commit sha
11+
* container-structure-test to check PHP version (currently set to 8.5.3)
12+
* container-structure-test to check swoole version (currently set to 6.2.0)
13+
* SECURITY.md to align with appwrite/appwrite
14+
15+
### Change
16+
17+
* .github/*.yml steps updated to latest versions
18+
* Better document use of `docker buildx ...` for local builds
19+
* Better noted and organized the different build processes for PHP extensions
20+
* Date component of PHP extension shared objects directory now a build argument
21+
* Dockerfile base now based on `phpswoole/swoole:php8.5-alpine`
22+
* Dockerfile compile and final stage system packages aligned
23+
* GitHub action for container-structure-test now uses a marketplace action
24+
* GitHub action runners pinned to Ubuntu 24.04
25+
* ImageMagick version bumped to 7.1.2.15 via APK
26+
* PHP version bumped to 8.5
27+
* Refactored multi-arch build process to prevent cross-arch builds requiring long wait times
28+
29+
### Fixes
30+
31+
* README.md usage instructions more detailed
32+
33+
### Miscellaneous
34+
35+
### Removed
36+
37+
* Build tools from final stage of Dockerfile
38+
* GitHub action to Setup QEMU as GitHub now provides native ARM runners

0 commit comments

Comments
 (0)