Skip to content

Commit f741363

Browse files
ruromeroruromero
authored
chore: build and publish container image to ghcr.io (#263)
* chore: build and publish container image to ghcr.io Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> * chore: add provenance and trigger on tag Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> --------- Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
1 parent f96b091 commit f741363

6 files changed

Lines changed: 355 additions & 23 deletions

File tree

‎.github/workflows/push-to-registry.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
3+
name: Push to registry
4+
5+
on:
6+
push:
7+
branches:
8+
- main
9+
- 'release/*'
10+
tags:
11+
- '*'
12+
workflow_dispatch:
13+
14+
env:
15+
REGISTRY: ghcr.io
16+
IMAGE_NAME: ${{ github.repository }}
17+
18+
jobs:
19+
build-and-push:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
23+
packages: write
24+
25+
steps:
26+
- name: Checkout repository
27+
uses: actions/checkout@v5
28+
29+
- name: Install node 18
30+
uses: actions/setup-node@v6
31+
with:
32+
node-version: 18
33+
cache: npm
34+
35+
- name: Install project modules
36+
run: npm ci
37+
38+
- name: Compile project
39+
run: npm run compile
40+
41+
- name: Get package version
42+
id: package-version
43+
run: |
44+
# Use git tag if available (for tag-triggered builds), otherwise use package.json
45+
if [ -n "${{ github.ref_type }}" ] && [ "${{ github.ref_type }}" = "tag" ]; then
46+
# Remove 'v' prefix if present (e.g., v1.0.0 -> 1.0.0)
47+
VERSION="${{ github.ref_name }}"
48+
VERSION="${VERSION#v}"
49+
else
50+
VERSION=$(node -p "require('./package.json').version")
51+
fi
52+
echo "version=$VERSION" >> $GITHUB_OUTPUT
53+
echo "Package version: $VERSION"
54+
55+
- name: Get image metadata
56+
id: image-meta
57+
run: |
58+
echo "revision=${{ github.sha }}" >> $GITHUB_OUTPUT
59+
echo "created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
60+
61+
- name: Set up Docker Buildx
62+
uses: docker/setup-buildx-action@v3
63+
64+
- name: Log in to Container Registry
65+
uses: docker/login-action@v3
66+
with:
67+
registry: ${{ env.REGISTRY }}
68+
username: ${{ github.actor }}
69+
password: ${{ secrets.GITHUB_TOKEN }}
70+
71+
- name: Extract metadata (tags, labels) for Docker
72+
id: meta
73+
uses: docker/metadata-action@v5
74+
with:
75+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
76+
tags: |
77+
type=raw,value=latest,enable={{is_default_branch}}
78+
type=raw,value=${{ steps.package-version.outputs.version }}
79+
80+
- name: Build and push Docker image
81+
uses: docker/build-push-action@v5
82+
with:
83+
context: .
84+
file: ./docker-image/Dockerfiles/Dockerfile
85+
push: true
86+
tags: ${{ steps.meta.outputs.tags }}
87+
labels: ${{ steps.meta.outputs.labels }}
88+
build-args: |
89+
IMAGE_VERSION=${{ steps.package-version.outputs.version }}
90+
IMAGE_REVISION=${{ steps.image-meta.outputs.revision }}
91+
IMAGE_CREATED=${{ steps.image-meta.outputs.created }}
92+
cache-from: type=gha
93+
cache-to: type=gha,mode=max
94+
provenance: true
95+
sbom: true

‎docker-image/Dockerfiles/Dockerfile‎

Lines changed: 31 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ FROM registry.access.redhat.com/ubi9/nodejs-20 AS builder
44
# use privilaged user
55
USER root
66

7-
ARG TRUSTIFY_DA_JAVASCRIPT_API_VERSION='0.2.4-ea.12'
8-
97
# install Java
108
RUN curl -kL https://download.oracle.com/java/21/archive/jdk-21.0.1_linux-x64_bin.tar.gz -o /tmp/java-package.tar.gz \
119
&& tar xvzf /tmp/java-package.tar.gz -C /usr/
@@ -19,20 +17,27 @@ RUN curl -kL https://go.dev/dl/go1.21.5.linux-amd64.tar.gz -o /tmp/golang-packag
1917
&& tar xvzf /tmp/golang-package.tar.gz -C /usr/
2018

2119
# install jq JSON formating tool
22-
RUN curl -kL https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux64 -o /usr/bin/jq
20+
RUN curl -kL https://github.com/jqlang/jq/releases/download/jq-1.8.1/jq-linux64 -o /usr/bin/jq
2321

24-
# install Exhort javascript API
25-
RUN npm install --global @trustify-da/trustify-da-javascript-client@${TRUSTIFY_DA_JAVASCRIPT_API_VERSION}
22+
# Copy RHDA script (before changing WORKDIR)
23+
COPY docker-image/scripts/rhda.sh /rhda.sh
2624

27-
# add RHDA script
28-
COPY scripts/rhda.sh /rhda.sh
25+
# Copy project files and install Exhort javascript API locally
26+
WORKDIR /app
27+
COPY package.json package-lock.json ./
28+
COPY dist ./dist
29+
COPY config ./config
30+
RUN npm install --production \
31+
&& mkdir -p /app/node_modules/.bin \
32+
&& ln -s /app/dist/src/cli.js /app/node_modules/.bin/trustify-da-javascript-client
2933

3034
# assign executable permissions to all installed binaries
3135
RUN chmod +x /usr/jdk-21.0.1/bin/java \
3236
&& chmod +x /usr/apache-maven-3.9.6/bin/mvn \
3337
&& chmod +x /usr/go/bin/go \
3438
&& chmod +x /usr/bin/jq \
35-
&& chmod +x /opt/app-root/src/.npm-global/bin/trustify-da-javascript-client \
39+
&& chmod +x /app/dist/src/cli.js \
40+
&& chmod +x /app/node_modules/.bin/trustify-da-javascript-client \
3641
&& chmod +x /rhda.sh
3742

3843
# use default user
@@ -41,10 +46,23 @@ USER default
4146
# second stage
4247
FROM registry.access.redhat.com/ubi9/nodejs-20-minimal
4348

49+
# Build arguments for metadata
50+
ARG IMAGE_VERSION
51+
ARG IMAGE_REVISION
52+
ARG IMAGE_CREATED
53+
54+
# Open Container Initiative (OCI) metadata labels
4455
LABEL org.opencontainers.image.source=https://github.com/guacsec/trustify-da-javascript-client
56+
LABEL org.opencontainers.image.description="Trustify Dependency Analytics JavaScript Client - Container image for dependency analysis and vulnerability scanning supporting Maven, NPM, Golang, and Python ecosystems"
57+
LABEL org.opencontainers.image.licenses=Apache-2.0
58+
LABEL org.opencontainers.image.title="Trustify Dependency Analytics JavaScript Client"
59+
LABEL org.opencontainers.image.vendor="guacsec"
60+
LABEL org.opencontainers.image.url=https://github.com/guacsec/trustify-da-javascript-client
61+
LABEL org.opencontainers.image.documentation=https://github.com/guacsec/trustify-da-javascript-client#README.md
62+
LABEL org.opencontainers.image.version="${IMAGE_VERSION}"
63+
LABEL org.opencontainers.image.revision="${IMAGE_REVISION}"
64+
LABEL org.opencontainers.image.created="${IMAGE_CREATED}"
4565

46-
# assign rhda source for exhort tracking purposes
47-
ENV RHDA_SOURCE=''
4866
# contains pip feeze --all data, base64 encoded
4967
ENV TRUSTIFY_DA_PIP_FREEZE=''
5068
# contains pip show data for all packages, base64 encoded
@@ -65,13 +83,13 @@ COPY --from=builder /usr/go/ /usr/go/
6583
ENV GOLANG_HOME=/usr/go
6684

6785
# Update PATH
68-
ENV PATH=$PATH:$JAVA_HOME/bin:$MAVEN_HOME/bin:$GOLANG_HOME/bin
86+
ENV PATH=$PATH:$JAVA_HOME/bin:$MAVEN_HOME/bin:$GOLANG_HOME/bin:/app/node_modules/.bin
6987

7088
# Copy jq executable from the builder stage
7189
COPY --from=builder /usr/bin/jq /usr/bin/jq
7290

73-
# Copy trustify-da-javascript-client executable from the builder stage
74-
COPY --from=builder /opt/app-root/src/.npm-global/ /opt/app-root/src/.npm-global/
91+
# Copy trustify-da-javascript-client from the builder stage
92+
COPY --from=builder /app /app
7593

7694
# Copy RHDA executable script from the builder stage
7795
COPY --from=builder /rhda.sh /rhda.sh

‎docker-image/README.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
1-
# Exhort Javascript API Docker Images
1+
# Trustify Dependency Analytics Javascript Client Container Images
22

3-
These dockerfiles provides all nessesary components to generate images for Red Hat Dependency Analytics (RHDA).
4-
These images can be used as base images to set up the necessary environment and dependencies for running the Red Hat Dependency Analytics.
3+
These dockerfiles provides all nessesary components to generate images for Trustify Dependency Analytics.
4+
These images can be used as base images to set up the necessary environment and dependencies for running the Trustify Dependency Analytics.
55

66
## Prerequisites
77
Before getting started, ensure that you have one of the following prerequisites installed on your system:
88

99
- Docker: [Installation Guide](https://docs.docker.com/get-docker/)
1010
- Podman: [Installation Guide](https://podman.io/docs/installation)
1111

12-
Both Docker and Podman are container runtimes that can be used to build and run the Red Hat Dependency Analytics images. You can choose either Docker or Podman based on your preference and the compatibility with your operating system.
12+
Both Docker and Podman are container runtimes that can be used to build and run the Trustify Dependency Analytics images. You can choose either Docker or Podman based on your preference and the compatibility with your operating system.
1313

14-
## Images generated for Exhort Javascript API
14+
## Images generated for Trustify Dependency Analytics Javascript Client
1515

1616
Ecosystem | Version | IMAGE | TAG |
1717
------------------------------| ------------------------------------------------------------------ | ----------------------------------------------- |-------------------|
18-
Maven, NPM, Golang | mvn 3.9.6, <br>npm 10.2.4, <br>go 1.21.5, <br>python \<any\> | quay.io/ecosystem-appeng/trustify-da-javascript-client | 0.1.1-ea.26 |
18+
Maven, NPM, Golang | mvn 3.9.6, <br>npm 10.2.4, <br>go 1.21.5, <br>python \<any\> | ghcr.io/guacsec/trustify-da-javascript-client | 0.2.4-ea.12 |
1919

2020

2121
## Usage Notes

‎docker-image/scripts/rhda.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ then
1919

2020
# Print stderr message to console
2121
error_message=$(sed -n '/^Error:/p' error.log)
22-
printf "\n[ERROR] Red Hat Dependency Analytics failed with exit code $exit_code.\n$error_message"
22+
printf "\n[ERROR] Trustify Dependency Analytics failed with exit code $exit_code.\n$error_message"
2323
exit 1
2424
else
2525
# In case of success print report summary into console
26-
printf "\nRed Hat Dependency Analytics Report\n"
26+
printf "\nTrustify Dependency Analytics Report\n"
2727
printf "=%.0s" {1..50}
2828
printf "\n"
2929
printf "Dependencies\n"

‎integration/scenarios/maven/expected_stack_html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@
196196
<th scope="col"># Transitive</th>
197197
<th scope="col">Highest CVSS</th>
198198
<th scope="col">Highest Severity</th>
199-
<th scope="col">Red Hat remediation available</th>
199+
<th scope="col">Remediation available</th>
200200
</tr>
201201
</thead>
202202
<tbody>
@@ -563,7 +563,7 @@
563563
</button>
564564
</div>
565565
<div class="modal-body">
566-
Click either VEX or SBOM to download the corresponding file type. You can also click the package name to view more information in Red Hat's Maven repository.
566+
Click either VEX or SBOM to download the corresponding file type. You can also click the package name to view more information in Trusted Content's Maven repository.
567567
</div>
568568
<div class="modal-footer" style="justify-content: space-around">
569569
<span id="vex"><a href="" target="_blank">VEX</a></span>

0 commit comments

Comments
 (0)