Skip to content

Commit 58d204e

Browse files
Copilotfrjcomp
Copilot
and
frjcomp
authored
Add minimal container image published to ghcr.io on release (#605)
* Add container image build workflow, Dockerfile, and documentation Agent-Logs-Url: https://github.com/CompassSecurity/pipeleek/sessions/de1b8658-5a1f-427f-9539-9616e902f77a Co-authored-by: frjcomp <107982661+frjcomp@users.noreply.github.com> * Address review comments: update docs wording and add Dependabot Docker support Agent-Logs-Url: https://github.com/CompassSecurity/pipeleek/sessions/23d24dcb-4fe1-4643-8908-40961478b1c2 Co-authored-by: frjcomp <107982661+frjcomp@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: frjcomp <107982661+frjcomp@users.noreply.github.com>
1 parent cbb2efc commit 58d204e

4 files changed

Lines changed: 122 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,11 @@ updates:
2828
interval: "weekly"
2929
cooldown:
3030
default-days: 7
31+
32+
# Docker base image dependencies
33+
- package-ecosystem: "docker"
34+
directory: "/"
35+
schedule:
36+
interval: "weekly"
37+
cooldown:
38+
default-days: 7

‎.github/workflows/container.yaml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: container
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
permissions:
8+
contents: read
9+
packages: write
10+
11+
jobs:
12+
build-and-push:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
17+
with:
18+
persist-credentials: false
19+
20+
- name: Set up QEMU
21+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
22+
23+
- name: Set up Docker Buildx
24+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
25+
26+
- name: Log in to GitHub Container Registry
27+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
28+
with:
29+
registry: ghcr.io
30+
username: ${{ github.actor }}
31+
password: ${{ secrets.GITHUB_TOKEN }}
32+
33+
- name: Docker metadata
34+
id: meta
35+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
36+
with:
37+
images: ghcr.io/${{ github.repository }}
38+
tags: |
39+
type=semver,pattern={{version}}
40+
type=semver,pattern={{major}}.{{minor}}
41+
type=raw,value=latest
42+
43+
- name: Download release binaries
44+
env:
45+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
46+
VERSION: ${{ github.event.release.tag_name }}
47+
run: |
48+
VERSION_NO_V="${VERSION#v}"
49+
gh release download "${VERSION}" \
50+
--pattern "pipeleek_${VERSION_NO_V}_linux_amd64" \
51+
--pattern "pipeleek_${VERSION_NO_V}_linux_arm64" \
52+
--repo "${{ github.repository }}"
53+
mv "pipeleek_${VERSION_NO_V}_linux_amd64" pipeleek_amd64
54+
mv "pipeleek_${VERSION_NO_V}_linux_arm64" pipeleek_arm64
55+
chmod +x pipeleek_amd64 pipeleek_arm64
56+
57+
- name: Build and push container image
58+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
59+
with:
60+
context: .
61+
platforms: linux/amd64,linux/arm64
62+
push: true
63+
tags: ${{ steps.meta.outputs.tags }}
64+
labels: ${{ steps.meta.outputs.labels }}

‎Dockerfile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
FROM alpine:3.21
2+
3+
RUN apk --no-cache add ca-certificates
4+
5+
ARG TARGETARCH
6+
7+
COPY pipeleek_${TARGETARCH} /usr/local/bin/pipeleek
8+
9+
RUN chmod +x /usr/local/bin/pipeleek
10+
11+
ENTRYPOINT ["/usr/local/bin/pipeleek"]

‎docs/introduction/getting_started.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,45 @@ go install github.com/CompassSecurity/pipeleek/cmd/pipeleek@latest
115115
.\pipeleek.exe --version
116116
```
117117

118+
### Docker
119+
120+
Pipeleek is available as a minimal container image on the GitHub Container Registry.
121+
122+
Pull the latest image:
123+
124+
```bash
125+
docker pull ghcr.io/compasssecurity/pipeleek:latest
126+
```
127+
128+
Run Pipeleek directly from the container:
129+
130+
```bash
131+
docker run --rm ghcr.io/compasssecurity/pipeleek:latest --version
132+
```
133+
134+
```bash
135+
docker run --rm ghcr.io/compasssecurity/pipeleek:latest gl scan --token glpat-[redacted] --gitlab https://gitlab.example.com
136+
```
137+
138+
You can also pass credentials via environment variables:
139+
140+
```bash
141+
docker run --rm \
142+
-e PIPELEEK_TOKEN=glpat-[redacted] \
143+
-e PIPELEEK_GITLAB=https://gitlab.example.com \
144+
ghcr.io/compasssecurity/pipeleek:latest gl scan
145+
```
146+
147+
To use a local configuration file inside the container, mount it as a volume:
148+
149+
```bash
150+
docker run --rm \
151+
-v /path/to/pipeleek.yaml:/root/pipeleek.yaml:ro \
152+
ghcr.io/compasssecurity/pipeleek:latest gl scan
153+
```
154+
155+
The image supports both `linux/amd64` and `linux/arm64` architectures. Versioned tags are available for pinning to a specific release (e.g., `ghcr.io/compasssecurity/pipeleek:1.0.0`).
156+
118157
### Platform-Specific Binaries
119158

120159
Pipeleek also provides platform-specific binaries that include only the commands for a specific platform. These are smaller and can be downloaded manually at [Pipeleek GitHub Releases](https://github.com/CompassSecurity/pipeleek/releases):

0 commit comments

Comments
 (0)