Skip to content

Commit bbc4176

Browse files
malice00malice00
authored
[build] Changed image builds to make use of Nexus on self-hosted runs. (#2153)
Changed image builds to make use of Nexus on self-hosted runs. Also refactored & reordered Dockerfiles. Signed-off-by: Roland Asmann <[email protected]>
1 parent 027c715 commit bbc4176

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+3444
-1812
lines changed

‎.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
**
2+
!.npmrc
23
!.pnpmfile.cjs
34
!bin/*
45
!ci/images/debian/install.sh

‎.github/actions/build-docker-image/action.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ inputs:
99
required: true
1010
labels:
1111
description: Labels to add to the image
12+
language:
13+
description: The language and version that is included in this image
14+
required: true
1215
output:
1316
description: Controls what should be done with the image(s) after building
1417
required: true
@@ -28,6 +31,10 @@ runs:
2831
- name: Build Docker image
2932
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
3033
with:
34+
build-args: |
35+
LANGUAGE=${{ inputs.language }}
36+
TAG=${{ inputs.tags[0] }}
37+
VERSION=${{ github.ref_name }}
3138
context: .
3239
file: ${{ inputs.dockerfile }}
3340
labels: ${{ inputs.labels }}

‎.github/actions/build-docker-images-generate-attach-sboms/action.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ inputs:
1313
images:
1414
description: The name(s) of the image(s) to load metadata for
1515
required: true
16+
language:
17+
description: The language and version that is included in this image
18+
required: true
1619
latest:
1720
description: Tag this image as 'latest' on top of the given tags
1821
required: true
@@ -40,6 +43,7 @@ runs:
4043
uses: ./.github/actions/build-docker-image
4144
with:
4245
dockerfile: ${{ inputs.dockerfile }}
46+
language: ${{ inputs.language }}
4347
labels: ${{ steps.metadata.outputs.labels }}
4448
output: registry
4549
platforms: linux/amd64${{ inputs.build-arm == 'true' && ',linux/arm64' || '' }}
@@ -49,6 +53,7 @@ runs:
4953
uses: ./.github/actions/generate-attach-sbom
5054
with:
5155
dockerfile: ${{ inputs.dockerfile }}
56+
language: ${{ inputs.language }}
5257
platform: linux/amd64
5358
signing-key: ${{ inputs.signing-key }}
5459
tag: ${{ inputs.main-tag || fromJSON(steps.metadata.outputs.json).tags[0] }}
@@ -58,6 +63,7 @@ runs:
5863
uses: ./.github/actions/generate-attach-sbom
5964
with:
6065
dockerfile: ${{ inputs.dockerfile }}
66+
language: ${{ inputs.language }}
6167
platform: linux/arm64
6268
signing-key: ${{ inputs.signing-key }}
6369
tag: ${{ inputs.main-tag || fromJSON(steps.metadata.outputs.json).tags[0] }}

‎.github/actions/generate-attach-sbom/action.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ inputs:
77
dockerfile:
88
description: Dockerfile that describes the image
99
required: true
10+
language:
11+
description: The language and version that is included in this image
12+
required: true
1013
platform:
1114
description: The platforms for which to build the image
1215
required: true
@@ -27,6 +30,7 @@ runs:
2730
uses: ./.github/actions/build-docker-image
2831
with:
2932
dockerfile: ${{ inputs.dockerfile }}
33+
language: ${{ inputs.language }}
3034
output: docker,dest=${{ runner.temp }}/image.tar
3135
platforms: ${{ inputs.platform }}
3236
tags: ${{ inputs.tag }}

‎.github/workflows/image-build.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ on:
1818
type: boolean
1919

2020
env:
21+
NEXUS_URL: http://100.73.146.80:8081/repository/npm/ # IP for mini-dev-1, sometimes docker engine can't resolve names!
2122
REPO: ghcr.io
2223
TAG: v11
2324
TEAM: cyclonedx
@@ -56,6 +57,9 @@ jobs:
5657
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
5758
- name: Setup ORAS
5859
uses: oras-project/setup-oras@8d34698a59f5ffe24821f0b48ab62a3de8b64b20 # v1.2.3
60+
- name: Setup Nexus usage
61+
if: ${{ fromJSON(inputs.image).runner }}
62+
run: echo "registry=$NEXUS_URL" > .npmrc
5963
- name: Install project dependencies
6064
run: |
6165
corepack pnpm install --config.strict-dep-builds=true --package-import-method copy --frozen-lockfile
@@ -92,6 +96,7 @@ jobs:
9296
${{ fromJSON(inputs.image).cdxgen-image.additional-image && format('{0}/{1}/{2}', env.REPO, env.TEAM, fromJSON(inputs.image).cdxgen-image.additional-image) || '' }}
9397
${{ fromJSON(inputs.image).cdxgen-image.additional-image2 && format('{0}/{1}/{2}', env.REPO, env.TEAM, fromJSON(inputs.image).cdxgen-image.additional-image2) || '' }}
9498
${{ fromJSON(inputs.image).cdxgen-image.additional-image3 && format('{0}/{1}/{2}', env.REPO, env.TEAM, fromJSON(inputs.image).cdxgen-image.additional-image3) || '' }}
99+
language: ${{ fromJSON(inputs.image).lang }}
95100
latest: ${{ inputs.latest }}
96101
main-tag: ${{ env.REPO }}/${{ env.TEAM }}/cdxgen${{ fromJSON(inputs.image).distro && format('-{0}', fromJSON(inputs.image).distro) }}-${{ fromJSON(inputs.image).lang }}:${{ env.TAG }}
97102
signing-key: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
@@ -112,6 +117,7 @@ jobs:
112117
${{ fromJSON(inputs.image).cdxgen-image.additional-image && format('{0}/{1}/{2}', env.REPO, env.TEAM, fromJSON(inputs.image).cdxgen-image.additional-image) || '' }}
113118
${{ fromJSON(inputs.image).cdxgen-image.additional-image2 && format('{0}/{1}/{2}', env.REPO, env.TEAM, fromJSON(inputs.image).cdxgen-image.additional-image2) || '' }}
114119
${{ fromJSON(inputs.image).cdxgen-image.additional-image3 && format('{0}/{1}/{2}', env.REPO, env.TEAM, fromJSON(inputs.image).cdxgen-image.additional-image3) || '' }}
120+
language: ${{ fromJSON(inputs.image).lang }}
115121
latest: ${{ inputs.latest }}
116122
signing-key: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
117123
target: cdxgen

‎ci/images/Dockerfile.dotnet7‎

Lines changed: 72 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,46 @@
11
# Base-image
22
FROM registry.suse.com/bci/dotnet-sdk:7.0 AS base
33

4-
ENV DOTNET_GENERATE_ASPNET_CERTIFICATE=false \
4+
ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 \
5+
DOTNET_GENERATE_ASPNET_CERTIFICATE=false \
56
DOTNET_NOLOGO=true \
7+
DOTNET_RUNNING_IN_CONTAINER=true \
68
DOTNET_USE_POLLING_FILE_WATCHER=false \
79
NUGET_XMLDOC_MODE=skip \
8-
DOTNET_RUNNING_IN_CONTAINER=true \
9-
DOTNET_CLI_TELEMETRY_OPTOUT=1 \
10+
PATH=${PATH}:/usr/local/bin \
11+
PYTHONPATH=/opt/pypi \
1012
npm_config_python=/usr/bin/python3.11
11-
ENV PATH=${PATH}:/usr/local/bin
1213

13-
RUN zypper refresh && zypper --non-interactive update && zypper --non-interactive install -l --no-recommends git-core nodejs20 npm20 python311 python311-pip wget zip unzip make gawk curl \
14-
&& npm install -g corepack \
15-
&& zypper clean -a
14+
RUN set -e; \
15+
zypper refresh \
16+
&& zypper \
17+
--non-interactive \
18+
update \
19+
&& zypper \
20+
--non-interactive \
21+
install \
22+
-l \
23+
--no-recommends \
24+
curl \
25+
gawk \
26+
git-core \
27+
make \
28+
nodejs20 \
29+
npm20 \
30+
python311 \
31+
python311-pip \
32+
unzip \
33+
wget \
34+
zip \
35+
&& pip install \
36+
--no-cache-dir \
37+
--target ${PYTHONPATH} \
38+
--upgrade \
39+
atom-tools \
40+
blint \
41+
&& npm install -g \
42+
corepack \
43+
&& zypper clean -a
1644

1745
CMD ["/bin/bash"]
1846

@@ -21,48 +49,57 @@ CMD ["/bin/bash"]
2149
# cdxgen-image
2250
FROM base AS cdxgen
2351

52+
ARG VERSION=master
53+
2454
LABEL maintainer="CycloneDX" \
55+
org.opencontainers.docker.cmd="docker run --rm -v /tmp:/tmp -p 9090:9090 -v $(pwd):/app:rw -t $TAG -r /app --server" \
2556
org.opencontainers.image.authors="Team AppThreat <[email protected]>" \
57+
org.opencontainers.image.description="Image with cdxgen SBOM generator for $LANGUAGE apps" \
58+
org.opencontainers.image.licenses="Apache-2.0" \
2659
org.opencontainers.image.source="https://github.com/CycloneDX/cdxgen" \
60+
org.opencontainers.image.title="cdxgen" \
2761
org.opencontainers.image.url="https://github.com/CycloneDX/cdxgen" \
28-
org.opencontainers.image.version="rolling" \
2962
org.opencontainers.image.vendor="CycloneDX" \
30-
org.opencontainers.image.licenses="Apache-2.0" \
31-
org.opencontainers.image.title="cdxgen" \
32-
org.opencontainers.image.description="Rolling image with cdxgen SBOM generator for dotnet 7 apps" \
33-
org.opencontainers.docker.cmd="docker run --rm -v /tmp:/tmp -p 9090:9090 -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen-dotnet7:v11 -r /app --server"
63+
org.opencontainers.image.version="$VERSION"
3464

3565
ENV CDXGEN_IN_CONTAINER=true \
66+
DOSAI_CMD=/usr/local/bin/dosai \
3667
NODE_COMPILE_CACHE="/opt/cdxgen-node-cache" \
37-
PYTHONPATH=/opt/pypi \
38-
DOSAI_CMD=/usr/local/bin/dosai
39-
ENV PATH=${PATH}:/usr/local/bin:${PYTHONPATH}/bin:/opt/cdxgen/node_modules/.bin
68+
PATH=${PATH}:${PYTHONPATH}/bin:/opt/cdxgen/node_modules/.bin
4069

4170
COPY . /opt/cdxgen
4271

4372
RUN set -e; \
4473
ARCH_NAME="$(rpm --eval '%{_arch}')"; \
45-
url=; \
4674
case "${ARCH_NAME##*-}" in \
47-
'x86_64') \
48-
DOSAI_ARCH_SUFFIX='-full'; \
49-
;; \
50-
'arm64') \
51-
DOSAI_ARCH_SUFFIX='-linux-arm64-full'; \
52-
;; \
53-
'aarch64') \
54-
DOSAI_ARCH_SUFFIX='-linux-arm64-full'; \
55-
;; \
56-
*) echo >&2 "error: unsupported architecture: '$ARCH_NAME'"; exit 1 ;; \
75+
'amd64' | 'x86_64') \
76+
DOSAI_ARCH_SUFFIX='-full'; \
77+
;; \
78+
'aarch64' | 'arm64') \
79+
DOSAI_ARCH_SUFFIX='-linux-arm64-full'; \
80+
;; \
81+
*) \
82+
echo >&2 "error: unsupported architecture: '$ARCH_NAME'"; \
83+
exit 1 \
84+
;; \
5785
esac \
58-
&& cd /opt/cdxgen && corepack enable && corepack pnpm install --config.strict-dep-builds=true --prod --package-import-method copy --frozen-lockfile && corepack pnpm cache delete \
59-
&& curl -L https://github.com/owasp-dep-scan/dosai/releases/latest/download/Dosai${DOSAI_ARCH_SUFFIX} -o /usr/local/bin/dosai \
60-
&& chmod +x /usr/local/bin/dosai \
61-
&& dosai --help \
62-
&& mkdir -p ${NODE_COMPILE_CACHE} \
63-
&& node /opt/cdxgen/bin/cdxgen.js --help \
64-
&& pip install --upgrade --no-cache-dir blint atom-tools --target /opt/pypi \
65-
&& rm -rf /root/.cache/node \
66-
&& chmod a-w -R /opt
86+
&& cd /opt/cdxgen \
87+
&& corepack enable \
88+
&& corepack pnpm install \
89+
--config.strict-dep-builds=true \
90+
--frozen-lockfile \
91+
--package-import-method copy \
92+
--prod \
93+
&& corepack pnpm cache delete \
94+
&& curl -L https://github.com/owasp-dep-scan/dosai/releases/latest/download/Dosai${DOSAI_ARCH_SUFFIX} \
95+
-o /usr/local/bin/dosai \
96+
&& chmod +x /usr/local/bin/dosai \
97+
&& dosai --help \
98+
&& mkdir -p ${NODE_COMPILE_CACHE} \
99+
&& node /opt/cdxgen/bin/cdxgen.js --help \
100+
&& rm -rf .npmrc /root/.cache/node \
101+
&& chmod a-w -R /opt
102+
67103
WORKDIR /app
104+
68105
ENTRYPOINT ["node", "/opt/cdxgen/bin/cdxgen.js"]

‎ci/images/Dockerfile.dotnet8‎

Lines changed: 73 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,47 @@
11
# Base-image
22
FROM registry.suse.com/bci/dotnet-sdk:8.0 AS base
33

4-
ENV DOTNET_GENERATE_ASPNET_CERTIFICATE=false \
4+
ENV DOTNET_CLI_TELEMETRY_OPTOUT=1 \
5+
DOTNET_GENERATE_ASPNET_CERTIFICATE=false \
56
DOTNET_NOLOGO=true \
7+
DOTNET_RUNNING_IN_CONTAINER=true \
68
DOTNET_USE_POLLING_FILE_WATCHER=false \
79
NUGET_XMLDOC_MODE=skip \
8-
DOTNET_RUNNING_IN_CONTAINER=true \
9-
DOTNET_CLI_TELEMETRY_OPTOUT=1 \
10+
PATH=${PATH}:/usr/local/bin \
11+
PYTHONPATH=/opt/pypi \
1012
npm_config_python=/usr/bin/python3.11
1113

12-
RUN zypper refresh && zypper --non-interactive update && zypper --non-interactive install -l --no-recommends git-core nodejs22 npm22 python311 python311-pip wget zip unzip make gawk java-21-openjdk-devel \
13-
&& dotnet --list-sdks \
14-
&& npm install -g corepack \
15-
&& zypper clean -a
14+
RUN set -e; \
15+
zypper refresh \
16+
&& zypper \
17+
--non-interactive \
18+
update \
19+
&& zypper \
20+
--non-interactive \
21+
install \
22+
-l \
23+
--no-recommends \
24+
gawk \
25+
git-core \
26+
java-21-openjdk-devel \
27+
make \
28+
nodejs22 \
29+
npm22 \
30+
python311 \
31+
python311-pip \
32+
unzip \
33+
wget \
34+
zip \
35+
&& pip install \
36+
--no-cache-dir \
37+
--target ${PYTHONPATH} \
38+
--upgrade \
39+
atom-tools \
40+
blint \
41+
&& dotnet --list-sdks \
42+
&& npm install -g \
43+
corepack \
44+
&& zypper clean -a
1645

1746
CMD ["/bin/bash"]
1847

@@ -21,48 +50,57 @@ CMD ["/bin/bash"]
2150
# cdxgen-image
2251
FROM base AS cdxgen
2352

53+
ARG VERSION=master
54+
2455
LABEL maintainer="CycloneDX" \
56+
org.opencontainers.docker.cmd="docker run --rm -v /tmp:/tmp -p 9090:9090 -v $(pwd):/app:rw -t $TAG -r /app --server" \
2557
org.opencontainers.image.authors="Team AppThreat <[email protected]>" \
58+
org.opencontainers.image.description="Image with cdxgen SBOM generator for $LANGUAGE apps" \
59+
org.opencontainers.image.licenses="Apache-2.0" \
2660
org.opencontainers.image.source="https://github.com/CycloneDX/cdxgen" \
61+
org.opencontainers.image.title="cdxgen" \
2762
org.opencontainers.image.url="https://github.com/CycloneDX/cdxgen" \
28-
org.opencontainers.image.version="rolling" \
2963
org.opencontainers.image.vendor="CycloneDX" \
30-
org.opencontainers.image.licenses="Apache-2.0" \
31-
org.opencontainers.image.title="cdxgen" \
32-
org.opencontainers.image.description="Rolling image with cdxgen SBOM generator for dotnet 8 apps" \
33-
org.opencontainers.docker.cmd="docker run --rm -v /tmp:/tmp -p 9090:9090 -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen-dotnet8:v11 -r /app --server"
64+
org.opencontainers.image.version="$VERSION"
3465

3566
ENV CDXGEN_IN_CONTAINER=true \
67+
DOSAI_CMD=/usr/local/bin/dosai \
3668
NODE_COMPILE_CACHE="/opt/cdxgen-node-cache" \
37-
PYTHONPATH=/opt/pypi \
38-
DOSAI_CMD=/usr/local/bin/dosai
39-
ENV PATH=${PATH}:/usr/local/bin:${PYTHONPATH}/bin:/opt/cdxgen/node_modules/.bin
69+
PATH=${PATH}:${PYTHONPATH}/bin:/opt/cdxgen/node_modules/.bin
4070

4171
COPY . /opt/cdxgen
4272

4373
RUN set -e; \
4474
ARCH_NAME="$(rpm --eval '%{_arch}')"; \
45-
url=; \
4675
case "${ARCH_NAME##*-}" in \
47-
'x86_64') \
48-
DOSAI_ARCH_SUFFIX='-full'; \
49-
;; \
50-
'arm64') \
51-
DOSAI_ARCH_SUFFIX='-linux-arm64-full'; \
52-
;; \
53-
'aarch64') \
54-
DOSAI_ARCH_SUFFIX='-linux-arm64-full'; \
55-
;; \
56-
*) echo >&2 "error: unsupported architecture: '$ARCH_NAME'"; exit 1 ;; \
76+
'amd64' | 'x86_64') \
77+
DOSAI_ARCH_SUFFIX='-full'; \
78+
;; \
79+
'aarch64' | 'arm64') \
80+
DOSAI_ARCH_SUFFIX='-linux-arm64-full'; \
81+
;; \
82+
*) \
83+
echo >&2 "error: unsupported architecture: '$ARCH_NAME'"; \
84+
exit 1 \
85+
;; \
5786
esac \
58-
&& cd /opt/cdxgen && corepack enable && corepack pnpm install --config.strict-dep-builds=true --prod --package-import-method copy --frozen-lockfile && corepack pnpm cache delete \
59-
&& curl -L https://github.com/owasp-dep-scan/dosai/releases/latest/download/Dosai${DOSAI_ARCH_SUFFIX} -o /usr/local/bin/dosai \
60-
&& chmod +x /usr/local/bin/dosai \
61-
&& dosai --help \
62-
&& mkdir -p ${NODE_COMPILE_CACHE} \
63-
&& node /opt/cdxgen/bin/cdxgen.js --help \
64-
&& pip install --upgrade --no-cache-dir blint atom-tools --target /opt/pypi \
65-
&& rm -rf /root/.cache/node \
66-
&& chmod a-w -R /opt
87+
&& cd /opt/cdxgen \
88+
&& corepack enable \
89+
&& corepack pnpm install \
90+
--config.strict-dep-builds=true \
91+
--frozen-lockfile \
92+
--package-import-method copy \
93+
--prod \
94+
&& corepack pnpm cache delete \
95+
&& curl -L https://github.com/owasp-dep-scan/dosai/releases/latest/download/Dosai${DOSAI_ARCH_SUFFIX} \
96+
-o /usr/local/bin/dosai \
97+
&& chmod +x /usr/local/bin/dosai \
98+
&& dosai --help \
99+
&& mkdir -p ${NODE_COMPILE_CACHE} \
100+
&& node /opt/cdxgen/bin/cdxgen.js --help \
101+
&& rm -rf .npmrc /root/.cache/node \
102+
&& chmod a-w -R /opt
103+
67104
WORKDIR /app
105+
68106
ENTRYPOINT ["node", "/opt/cdxgen/bin/cdxgen.js"]

0 commit comments

Comments
 (0)