crowd.dev/scripts/services/docker/Dockerfile.security_best_practices_worker at f41380efe3ec5af2ea072fe098bf6b486346b4b3 · linuxfoundation/crowd.dev · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
ARG PVTR_VERSION=v0.24.0

FROM alpine:3.21 AS core
RUN apk add --no-cache wget tar unzip

WORKDIR /app
ARG VERSION=0.21.2
ARG PLATFORM=Linux_x86_64

RUN wget https://github.com/privateerproj/privateer/releases/download/v${VERSION}/privateer_${PLATFORM}.tar.gz
RUN tar -xzf privateer_${PLATFORM}.tar.gz

FROM golang:1.26.4-alpine3.22 AS plugin
RUN apk add --no-cache make git
WORKDIR /plugin
ARG PVTR_COMMIT=c1095c95a1b399ec63e4f4e2b7880b0ef55e604f
ARG PVTR_VERSION
# To run the latest version of the plugin, we need to use the latest commit of the pvtr-github-repo-scanner repository.
# Currently using v0.24.0+2fixes: https://github.com/ossf/pvtr-github-repo-scanner/commit/c1095c95a1b399ec63e4f4e2b7880b0ef55e604f
RUN git clone https://github.com/ossf/pvtr-github-repo-scanner.git && cd pvtr-github-repo-scanner && git checkout ${PVTR_COMMIT}
RUN cd pvtr-github-repo-scanner && make binary && cp github-repo ../github-repo

FROM node:20-alpine as builder

RUN apk add --no-cache python3 make g++

WORKDIR /usr/crowd/app
RUN npm install -g corepack@latest && corepack enable pnpm && corepack prepare pnpm@9.15.0 --activate

COPY ./pnpm-workspace.yaml ./pnpm-lock.yaml ./
RUN pnpm fetch

COPY ./services ./services
RUN pnpm i --frozen-lockfile

FROM node:20-bookworm-slim as runner

RUN mkdir -p /.privateer/bin
WORKDIR /.privateer/bin
COPY --from=core /app/pvtr ./privateer
ARG PVTR_VERSION
COPY --from=plugin /plugin/github-repo /root/.privateer/bin/github-repo
RUN echo "{\"plugins\":[{\"name\":\"github-repo\",\"version\":\"${PVTR_VERSION}\",\"binaryPath\":\"github-repo\"}]}" > /root/.privateer/bin/plugins.json
COPY ./services/apps/security_best_practices_worker/example-config.yml /.privateer/example-config.yml

WORKDIR /usr/crowd/app
RUN npm install -g corepack@latest && corepack enable pnpm && corepack prepare pnpm@9.15.0 --activate && apt update && apt install -y ca-certificates --no-install-recommends && rm -rf /var/lib/apt/lists/*

COPY --from=builder /usr/crowd/app/node_modules ./node_modules
COPY --from=builder /usr/crowd/app/services/base.tsconfig.json ./services/base.tsconfig.json
COPY --from=builder /usr/crowd/app/services/libs ./services/libs
COPY --from=builder /usr/crowd/app/services/archetypes/ ./services/archetypes
COPY --from=builder /usr/crowd/app/services/apps/security_best_practices_worker/ ./services/apps/security_best_practices_worker