Guiillaume Hemmen
0bd84540a6
# Overview This PR introduces several improvements to our Docker infrastructure, focusing on security, base image optimization, and workflow automation. # Key Changes ## Base Image Updates - Updated system package installation and cleanup processes ## Security Enhancements - Implemented Trivy security scanning in the Dockerfile - Adjusted Trivy scan configuration to handle known Debian vulnerabilities - Enhanced container security by ensuring proper ownership of `/workspaces` directory ## CI/CD Improvements - Added manual workflow dispatch capability to Docker workflows - Implemented cron scheduling for automated builds - Enhanced Docker image configuration and build process # Technical Details - Trivy security scanning is now implemented using a script-based installation method - Workflow improvements allow both scheduled and manual triggering of Docker builds # Security Considerations - Trivy scan exit code has been set to 0 to accommodate known Debian vulnerabilities while maintaining security awareness - Proper directory permissions and ownership are maintained for `/workspaces` # Impact These changes improve our Docker image by: - Reducing image size and improving build efficiency - Enhancing security scanning capabilities - Providing more flexible deployment options through manual triggers - Ensuring consistent automated builds through cron scheduling # Reviewer Notes Please pay special attention to: - The base image change and its impact on existing workflows - Security scanning configuration - Workflow trigger modifications Reviewed-on: #1 Co-authored-by: Guiillaume Hemmen <guillaume@van-hemmen.com> Co-committed-by: Guiillaume Hemmen <guillaume@van-hemmen.com>
26 lines
1,005 B
YAML
26 lines
1,005 B
YAML
on:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
schedule:
|
|
- cron: '0 0 * * *'
|
|
workflow_dispatch:
|
|
jobs:
|
|
docker-master:
|
|
runs-on: docker
|
|
container:
|
|
image: git.van-hemmen.com/actions/kaniko:25.21.1
|
|
steps:
|
|
- name: Build & push with Kaniko
|
|
run: /bin/build.sh
|
|
env:
|
|
# --- mandatory --------------------------------------------------------
|
|
KANIKO_CONTEXT: git://git.van-hemmen.com/guillaumehemmen/debian-node-firebase.git
|
|
GIT_REF_NAME: ${{ github.ref_name }}
|
|
GIT_USERNAME: ${{ secrets.docker_username }}
|
|
GIT_PASSWORD: ${{ secrets.access_token }}
|
|
|
|
# --- optional (only needed when you plan to push) ---------------------
|
|
REGISTRY_USER: ${{ secrets.docker_username }}
|
|
REGISTRY_PASS: ${{ secrets.access_token }}
|
|
KANIKO_DESTINATION: git.van-hemmen.com/guillaumehemmen/debian-node-firebase:debian_12-node_22,git.van-hemmen.com/guillaumehemmen/debian-node-firebase:latest
|