From 987c5146d29cccd485f3fc641eeb7652c97890b3 Mon Sep 17 00:00:00 2001 From: Andrei Jiroh Halili Date: Mon, 1 Jul 2024 19:38:10 +0800 Subject: [PATCH] chore(mkdocs-material): implement some hadolint fixes alongside adding project-wide config --- .github/workflows/docker-buildops.yml | 45 ++++++++++++++++++++++----- .hadolint.yml | 7 +++++ docker/mkdocs-material/Dockerfile | 8 +++-- 3 files changed, 49 insertions(+), 11 deletions(-) create mode 100644 .hadolint.yml diff --git a/.github/workflows/docker-buildops.yml b/.github/workflows/docker-buildops.yml index a1ad038..5e2a33e 100644 --- a/.github/workflows/docker-buildops.yml +++ b/.github/workflows/docker-buildops.yml @@ -26,10 +26,8 @@ permissions: attestations: write jobs: - mkdocs-material: - name: Custom image on Material for Mkdocs + lint: runs-on: ubuntu-latest - steps: - name: Checkout repository uses: actions/checkout@v4 @@ -38,9 +36,20 @@ jobs: - name: Lint Dockerfile uses: hadolint/hadolint-action@v3.1.0 with: - dockerfile: docker/mkdocs-material/Dockerfile + dockerfile: Dockerfile + recursive: true + trusted-registries: quay.io, ghcr.io continue-on-error: true + mkdocs-material: + name: Custom image on Material for Mkdocs + runs-on: ubuntu-latest + needs: [ lint ] + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@v2 @@ -99,7 +108,23 @@ jobs: # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action - name: Build and push Docker image - id: build-and-push + if: github.event_name == 'schedule' + id: build + uses: docker/build-push-action@v4.1.1 + with: + context: docker/mkdocs-material + #file: Dockerfile + # workaround: https://github.com/moby/buildkit/issues/2713#issuecomment-1068540101 + push: true + #load: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha,scope=buildkit-mkdocs-material + cache-to: type=gha,mode=max,scope=buildkit-mkdocs-material + + - name: Build and push Docker image + if: github.event_name == 'schedule' + id: build uses: docker/build-push-action@v4.1.1 with: context: docker/mkdocs-material @@ -112,23 +137,27 @@ jobs: cache-from: type=gha,scope=buildkit-mkdocs-material cache-to: type=gha,mode=max,scope=buildkit-mkdocs-material - # https://github.com/sigstore/cosign + # First, we sign our images with cosign first... - name: Sign the published Docker image with cosign if: ${{ github.event_name != 'pull_request' }} id: cosign env: # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable TAGS: ${{ steps.meta.outputs.tags }} - DIGEST: ${{ steps.build-and-push.outputs.digest }} + DIGEST: ${{ steps.build.outputs.digest }} run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} + + # ...and then generate a build attestation via actions/attest-build-provenance workflow. - uses: actions/attest-build-provenance@v1 if: ${{ github.event_name != 'pull_request' }} id: attest with: subject-name: ghcr.io/${{ env.IMAGE_NAME_PREFIX }}/mkdocs-material - subject-digest: ${{ steps.build-and-push.outputs.digest }} + subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true + # Note that we upload the bundle file from attest job above for easy access. - uses: actions/upload-artifact@v4 + if: ${{ github.event_name != 'pull_request' }} with: name: buildkit-attestation_mkdocs-material path: ${{ steps.attest.outputs.bundle-path }} \ No newline at end of file diff --git a/.hadolint.yml b/.hadolint.yml new file mode 100644 index 0000000..f7dbcd7 --- /dev/null +++ b/.hadolint.yml @@ -0,0 +1,7 @@ +# yaml-language-server: $schema=https://github.com/hadolint/hadolint/raw/master/contrib/hadolint.json +trusted-registries: +- ghcr.io +- quay.io +- dock.mau.dev +ignored: +- DL3013 \ No newline at end of file diff --git a/docker/mkdocs-material/Dockerfile b/docker/mkdocs-material/Dockerfile index 4033454..b105d8c 100644 --- a/docker/mkdocs-material/Dockerfile +++ b/docker/mkdocs-material/Dockerfile @@ -10,7 +10,7 @@ LABEL org.opencontainers.image.description="GitLab CI image for a custom mkdocs- org.opencontainers.image.url="https://go.andreijiroh.xyz/mkdocs-material" \ org.opencontainers.image.documentation="https://github.com/andreijiroh-dev/docker-images/blob/main/docker/mkdocs-material/README.md" \ dev.recaptime.opensource.stabilityLevel="unstable" dev.recaptime.opensource.maintainer="ajhalili2006" \ - org.opencontainers.image.license="MPL-2.0" + dev.recaptime.opensource.license="MPL-2.0" dev.recaptime.opensource.repoOwnerType="staff-verified-public" org.opencontainers.image.license="MPL-2.0" # Since hadolint isn't in the package repos for Alpine yet, we'll copying from the offical @@ -21,6 +21,9 @@ COPY --from=ghcr.io/hadolint/hadolint:latest-alpine /bin/hadolint /usr/bin/hadol COPY entrypoint.sh /usr/local/bin/entrypoint.sh RUN chmod +x /usr/local/bin/entrypoint.sh +# https://github.com/hadolint/hadolint/wiki/DL4006 +SHELL ["/bin/ash", "-eo", "pipefail", "-c"] + # https://squidfunk.github.io/mkdocs-material/setup/setting-up-social-cards/#linux but for Alpine # Also installs Doppler CLI for accessing secrets securely within CI # hadolint ignore=DL3018,DL3013 @@ -35,7 +38,6 @@ RUN apk add --no-cache \ coreutils \ shellcheck \ gcc \ - libffi-dev \ musl-dev \ git \ git-email \ @@ -67,7 +69,7 @@ RUN ln -s /usr/local/bin/node /usr/local/bin/nodejs \ # See https://www.jeffgeerling.com/blog/2023/how-solve-error-externally-managed-environment-when-installing-pip3 # for context behind removing the EXTERNALLY-MANAGED file on distribution-built CPython binary releases. # Since we're using the official Python Docker image, we don't need to worry about that. -RUN pip install --no-cache \ +RUN pip install --no-cache-dir \ mkdocs-material \ mkdocs-git-committers-plugin-2 \ mkdocs-git-revision-date-localized-plugin \ -- 2.51.2