diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index dc51a25..ee12927 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -9,17 +9,24 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v1 + - uses: actions/checkout@v4 - name: Set tag var id: vars - run: echo ::set-output name=docker_tag::$(echo ${GITHUB_REF} | cut -d'/' -f3)-${GITHUB_SHA} + run: echo "docker_tag=$(echo ${GITHUB_REF} | cut -d'/' -f3)-${GITHUB_SHA}" >> $GITHUB_OUTPUT - name: Build the Docker image - run: docker build . --file ./3.8/Dockerfile --tag docker-terraform:${{ steps.vars.outputs.docker_tag }} + run: docker build . --file ./3.12/Dockerfile --tag serverless-python:${{ steps.vars.outputs.docker_tag }} - - name: Scan with Phonito Security - uses: phonito/phonito-scanner-action@master + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master with: - image: docker-terraform:${{ steps.vars.outputs.docker_tag }} - phonito-token: ${{ secrets.PHONITO_TOKEN }} \ No newline at end of file + image-ref: serverless-python:${{ steps.vars.outputs.docker_tag }} + format: 'sarif' + output: 'trivy-results.sarif' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + if: always() + with: + sarif_file: 'trivy-results.sarif' diff --git a/3.10/Dockerfile b/3.10/Dockerfile index 0c20298..095885a 100644 --- a/3.10/Dockerfile +++ b/3.10/Dockerfile @@ -1,23 +1,27 @@ -FROM python:3.10-slim-buster +FROM python:3.10-slim-bookworm RUN apt-get update && \ apt-get install -y \ - wget=1.20.1-1.1 \ - zip=3.0-11+b1 \ - unzip=6.0-23+deb10u2 \ - git=1:2.20.1-2+deb10u3 \ + wget \ + zip \ + unzip \ + git \ curl \ - npm=5.8.0+ds6-4+deb10u2 && \ - pip3 install --no-cache-dir --upgrade pip==23.3.1 && \ - npm install npm@7.0 -g && \ - npm install -g serverless@3.36.0 && \ - npm install -g serverless-compose@2.4.0 &&\ + ca-certificates \ + gnupg && \ + pip3 install --no-cache-dir --upgrade pip==25.1.1 && \ apt-get -q -y clean && \ rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* -ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 -RUN curl -sL https://deb.nodesource.com/setup_18.x | bash -RUN apt-get install -y nodejs +RUN mkdir -p /etc/apt/keyrings && \ + curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \ + echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \ + apt-get update && \ + apt-get install -y nodejs && \ + npm install -g serverless@3.36.0 && \ + npm install -g serverless-compose@2.4.0 && \ + apt-get -q -y clean && \ + rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* WORKDIR /work diff --git a/3.11/Dockerfile b/3.11/Dockerfile index 9a5ab62..806dde4 100644 --- a/3.11/Dockerfile +++ b/3.11/Dockerfile @@ -1,23 +1,27 @@ -FROM python:3.11-slim-buster +FROM python:3.11-slim-bookworm RUN apt-get update && \ apt-get install -y \ - wget=1.20.1-1.1 \ - zip=3.0-11+b1 \ - unzip=6.0-23+deb10u2 \ - git=1:2.20.1-2+deb10u3 \ + wget \ + zip \ + unzip \ + git \ curl \ - npm=5.8.0+ds6-4+deb10u2 && \ - pip3 install --no-cache-dir --upgrade pip==23.3.1 && \ - npm install npm@7.0 -g && \ - npm install -g serverless@3.36.0 && \ - npm install -g serverless-compose@2.4.0 &&\ + ca-certificates \ + gnupg && \ + pip3 install --no-cache-dir --upgrade pip==25.1.1 && \ apt-get -q -y clean && \ rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* -ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 -RUN curl -sL https://deb.nodesource.com/setup_18.x | bash -RUN apt-get install -y nodejs +RUN mkdir -p /etc/apt/keyrings && \ + curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \ + echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \ + apt-get update && \ + apt-get install -y nodejs && \ + npm install -g serverless@3.36.0 && \ + npm install -g serverless-compose@2.4.0 && \ + apt-get -q -y clean && \ + rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* WORKDIR /work diff --git a/3.12/Dockerfile b/3.12/Dockerfile new file mode 100644 index 0000000..23c837f --- /dev/null +++ b/3.12/Dockerfile @@ -0,0 +1,28 @@ +FROM python:3.12-slim-bookworm + +RUN apt-get update && \ + apt-get install -y \ + wget \ + zip \ + unzip \ + git \ + curl \ + ca-certificates \ + gnupg && \ + pip3 install --no-cache-dir --upgrade pip==25.1.1 && \ + apt-get -q -y clean && \ + rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* + +RUN mkdir -p /etc/apt/keyrings && \ + curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \ + echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \ + apt-get update && \ + apt-get install -y nodejs && \ + npm install -g serverless@3.36.0 && \ + npm install -g serverless-compose@2.4.0 && \ + apt-get -q -y clean && \ + rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* + +WORKDIR /work + +ENTRYPOINT ["/bin/sh"] diff --git a/3.6/Dockerfile b/3.6/Dockerfile deleted file mode 100644 index b6baecf..0000000 --- a/3.6/Dockerfile +++ /dev/null @@ -1,24 +0,0 @@ -FROM python:3.6-slim-buster - -RUN apt-get update && \ - apt-get install -y \ - wget=1.20.1-1.1 \ - zip=3.0-11+b1 \ - unzip=6.0-23+deb10u2 \ - git=1:2.20.1-2+deb10u3 \ - curl \ - npm=5.8.0+ds6-4+deb10u2 && \ - pip3 install --no-cache-dir --upgrade pip==20.1.1 && \ - npm install npm@7.0.0 -g && \ - npm install -g serverless@3.36.0 && \ - npm install -g serverless-compose@2.4.0 &&\ - apt-get -q -y clean && \ - rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* - -ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 -RUN curl -sL https://deb.nodesource.com/setup_18.x | bash -RUN apt-get install -y nodejs - -WORKDIR /work - -ENTRYPOINT ["/bin/sh"] diff --git a/3.7/Dockerfile b/3.7/Dockerfile deleted file mode 100644 index 19750b0..0000000 --- a/3.7/Dockerfile +++ /dev/null @@ -1,24 +0,0 @@ -FROM python:3.7-slim-buster - -RUN apt-get update && \ - apt-get install -y \ - wget=1.20.1-1.1 \ - zip=3.0-11+b1 \ - unzip=6.0-23+deb10u2 \ - git=1:2.20.1-2+deb10u3 \ - curl \ - npm=5.8.0+ds6-4+deb10u2 && \ - pip3 install --no-cache-dir --upgrade pip==20.1.1 && \ - npm install npm@7.0.0 -g && \ - npm install -g serverless@3.36.0 && \ - npm install -g serverless-compose@2.4.0 &&\ - apt-get -q -y clean && \ - rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* - -ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 -RUN curl -sL https://deb.nodesource.com/setup_18.x | bash -RUN apt-get install -y nodejs - -WORKDIR /work - -ENTRYPOINT ["/bin/sh"] diff --git a/3.8/Dockerfile b/3.8/Dockerfile deleted file mode 100644 index 87cb2c6..0000000 --- a/3.8/Dockerfile +++ /dev/null @@ -1,24 +0,0 @@ -FROM python:3.8-slim-buster - -RUN apt-get update && \ - apt-get install -y \ - wget=1.20.1-1.1 \ - zip=3.0-11+b1 \ - unzip=6.0-23+deb10u2 \ - git=1:2.20.1-2+deb10u3 \ - curl \ - npm=5.8.0+ds6-4+deb10u2 && \ - pip3 install --no-cache-dir --upgrade pip==20.1.1 && \ - npm install npm@7.0.0 -g && \ - npm install -g serverless@3.36.0 && \ - npm install -g serverless-compose@2.4.0 &&\ - apt-get -q -y clean && \ - rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* - -ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 -RUN curl -sL https://deb.nodesource.com/setup_18.x | bash -RUN apt-get install -y nodejs - -WORKDIR /work - -ENTRYPOINT ["/bin/sh"] diff --git a/3.8/hadolint.yaml b/3.8/hadolint.yaml deleted file mode 100644 index 0c6074f..0000000 --- a/3.8/hadolint.yaml +++ /dev/null @@ -1,4 +0,0 @@ -ignored: - - DL3008 - - DL3015 - - DL4006 \ No newline at end of file diff --git a/3.9/Dockerfile b/3.9/Dockerfile index 3dccac3..604a343 100644 --- a/3.9/Dockerfile +++ b/3.9/Dockerfile @@ -1,23 +1,27 @@ -FROM python:3.9-slim-buster +FROM python:3.9-slim-bookworm RUN apt-get update && \ apt-get install -y \ - wget=1.20.1-1.1 \ - zip=3.0-11+b1 \ - unzip=6.0-23+deb10u2 \ - git=1:2.20.1-2+deb10u3 \ + wget \ + zip \ + unzip \ + git \ curl \ - npm=5.8.0+ds6-4+deb10u2 && \ - pip3 install --no-cache-dir --upgrade pip==23.3.1 && \ - npm install npm@7.0.0 -g && \ - npm install -g serverless@3.36.0 && \ - npm install -g serverless-compose@2.4.0 &&\ + ca-certificates \ + gnupg && \ + pip3 install --no-cache-dir --upgrade pip==25.1.1 && \ apt-get -q -y clean && \ rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* -ARG APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 -RUN curl -sL https://deb.nodesource.com/setup_18.x | bash -RUN apt-get install -y nodejs +RUN mkdir -p /etc/apt/keyrings && \ + curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \ + echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list && \ + apt-get update && \ + apt-get install -y nodejs && \ + npm install -g serverless@3.36.0 && \ + npm install -g serverless-compose@2.4.0 && \ + apt-get -q -y clean && \ + rm -rf /var/cache/apt/archives/* /var/lib/apt/lists/* WORKDIR /work diff --git a/Makefile b/Makefile index 2ffb99f..d99ce1f 100644 --- a/Makefile +++ b/Makefile @@ -2,54 +2,32 @@ build: echo "Build specific tag/release" - # Python 3.6 - docker build \ - --build-arg base_image=python:3.6-slim \ - -t ${REPO}:3.6-${IMAGE_TAG} \ - ./3.6/. - - # Python 3.7 - docker build \ - --build-arg base_image=python:3.7-slim \ - -t ${REPO}:3.7-${IMAGE_TAG} \ - ./3.7/. - - # Python 3.8 - docker build \ - --build-arg base_image=python:3.8-slim \ - -t ${REPO}:3.8-${IMAGE_TAG} \ - ./3.8/. - # Python 3.9 docker build \ - --build-arg base_image=python:3.9-slim \ + --build-arg base_image=python:3.9-slim-bookworm \ -t ${REPO}:3.9-${IMAGE_TAG} \ ./3.9/. # Python 3.10 docker build \ - --build-arg base_image=python:3.10-slim \ + --build-arg base_image=python:3.10-slim-bookworm \ -t ${REPO}:3.10-${IMAGE_TAG} \ ./3.10/. # Python 3.11 docker build \ - --build-arg base_image=python:3.11-slim \ + --build-arg base_image=python:3.11-slim-bookworm \ -t ${REPO}:3.11-${IMAGE_TAG} \ ./3.11/. + # Python 3.12 + docker build \ + --build-arg base_image=python:3.12-slim-bookworm \ + -t ${REPO}:3.12-${IMAGE_TAG} \ + ./3.12/. push: echo "Push specific tag/release" - # Python 3.6 - docker push ${REPO}:3.6-${IMAGE_TAG} - - # Python 3.7 - docker push ${REPO}:3.7-${IMAGE_TAG} - - # Python 3.8 - docker push ${REPO}:3.8-${IMAGE_TAG} - # Python 3.9 docker push ${REPO}:3.9-${IMAGE_TAG} @@ -57,4 +35,7 @@ push: docker push ${REPO}:3.10-${IMAGE_TAG} # Python 3.11 - docker push ${REPO}:3.11-${IMAGE_TAG} \ No newline at end of file + docker push ${REPO}:3.11-${IMAGE_TAG} + + # Python 3.12 + docker push ${REPO}:3.12-${IMAGE_TAG} \ No newline at end of file diff --git a/test/build-images.sh b/test/build-images.sh index 625fb9f..8eca229 100755 --- a/test/build-images.sh +++ b/test/build-images.sh @@ -2,36 +2,38 @@ set -ex DOCKER_REPO=dnxsolutions/serverless-python -DOCKER_TAG=dnx-local +DOCKER_TAG=${DOCKER_TAG:-dnx-local} IMAGE_NAME=${DOCKER_REPO}:${DOCKER_TAG} -if [ ${DOCKER_TAG} != "latest" ] -then - echo "Build specific tag/release" - - # Python 3.6 - docker build \ - -f ../3.6/Dockerfile \ - -t ${DOCKER_REPO}:3.6-${DOCKER_TAG} \ - . - - # Python 3.7 - docker build \ - -f ../3.7/Dockerfile \ - -t ${DOCKER_REPO}:3.7-${DOCKER_TAG} \ - . - - # Python 3.8 - docker build \ - -f ../3.8/Dockerfile \ - -t ${DOCKER_REPO}:3.8-${DOCKER_TAG} \ - . -else - echo "Build latest" - - # Python 3.8 - docker build \ - -f ../3.8/Dockerfile \ - -t ${IMAGE_NAME} \ - . -fi \ No newline at end of file +echo "Building Docker images with tag: ${DOCKER_TAG}" + +# Build all Python versions +echo "Building Python 3.9..." +docker build \ + -f ../3.9/Dockerfile \ + -t ${DOCKER_REPO}:3.9-${DOCKER_TAG} \ + .. + +echo "Building Python 3.10..." +docker build \ + -f ../3.10/Dockerfile \ + -t ${DOCKER_REPO}:3.10-${DOCKER_TAG} \ + .. + +echo "Building Python 3.11..." +docker build \ + -f ../3.11/Dockerfile \ + -t ${DOCKER_REPO}:3.11-${DOCKER_TAG} \ + .. + +echo "Building Python 3.12..." +docker build \ + -f ../3.12/Dockerfile \ + -t ${DOCKER_REPO}:3.12-${DOCKER_TAG} \ + .. + +echo "All builds completed successfully!" + +# List the built images +echo "Built images:" +docker images | grep ${DOCKER_REPO} | grep ${DOCKER_TAG}