Skip to content

Commit f3167ca

Browse files
ggguardianggguardian
authored
Merge pull request #1 from GitGuardian/ggguardian/fix-minio-bitnami-images
feat(minio-bitnami): fix permissions
2 parents 42a372b + 56885c0 commit f3167ca

File tree

5 files changed

+85
-39
lines changed

5 files changed

+85
-39
lines changed

‎.github/workflows/minio-bitnami-client.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,16 @@ name: minio-bitnami-client
33
on:
44
schedule:
55
- cron: "00 01 * * 1"
6+
pull_request:
7+
paths:
8+
- .github/workflows/minio-bitnami-client.yaml
9+
- 'images/minio-bitnami-client/**.yaml'
610
push:
711
branches:
812
- 'main'
913
paths:
1014
- .github/workflows/minio-bitnami-client.yaml
11-
- 'images/minio-bitnami-client/*.yaml'
15+
- 'images/minio-bitnami-client/**.yaml'
1216
workflow_dispatch:
1317

1418
permissions:

‎.github/workflows/minio-bitnami.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,16 @@ name: minio-bitnami
33
on:
44
schedule:
55
- cron: "00 01 * * 1-5"
6+
pull_request:
7+
paths:
8+
- .github/workflows/minio-bitnami.yaml
9+
- 'images/minio-bitnami/**.yaml'
610
push:
711
branches:
812
- 'main'
913
paths:
1014
- .github/workflows/minio-bitnami.yaml
11-
- 'images/minio-bitnami/*.yaml'
15+
- 'images/minio-bitnami/**.yaml'
1216
workflow_dispatch:
1317

1418
permissions:

‎.github/workflows/release.yaml‎

Lines changed: 27 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,6 @@ name: Reusable release workflow
33
on:
44
workflow_call:
55
inputs:
6-
registry:
7-
description: 'Registry'
8-
type: string
9-
required: false
10-
default: ghcr.io
11-
registry-username:
12-
description: 'Registry username'
13-
type: string
14-
required: false
15-
default: ${{ github.actor }}
16-
registry-password:
17-
description: 'Registry password'
18-
type: string
19-
required: false
20-
default: ''
216
image:
227
description: 'Image name'
238
type: string
@@ -70,17 +55,27 @@ jobs:
7055
steps:
7156
- uses: imjasonh/[email protected]
7257
- uses: sigstore/cosign-installer@v3
73-
7458
- name: Checkout
7559
uses: actions/checkout@v4
7660

77-
- name: Login to Registry
61+
- name: Set Vars
62+
id: vars
63+
shell: bash
64+
run: |
65+
if [[ "${{ github.ref_name }}" == "main" ]]; then
66+
echo "registry=ghcr.io" >> $GITHUB_OUTPUT
67+
else
68+
echo "registry=ttl.sh" >> $GITHUB_OUTPUT
69+
fi
70+
71+
- if: steps.vars.outputs.registry == 'ghcr.io'
72+
name: Login to GitHub Registry
7873
uses: docker/login-action@v3
7974
id: login-to-registry
8075
with:
81-
registry: ${{ inputs.registry }}
82-
username: ${{ inputs.registry-username }}
83-
password: ${{ inputs.registry-password || github.token }}
76+
registry: ghcr.io
77+
username: ${{ github.actor }}
78+
password: ${{ github.token }}
8479

8580
- name: Create SBOM directory
8681
id: output
@@ -93,22 +88,22 @@ jobs:
9388
uses: distroless/actions/apko-publish@main
9489
with:
9590
config: ${{ inputs.config-dir }}/${{ inputs.target }}.yaml
96-
tag: ${{ inputs.registry }}/${{ inputs.image }}:${{ inputs.tag }}
91+
tag: ${{ steps.vars.outputs.registry }}/${{ inputs.image }}:${{ inputs.tag }}
9792
package-append: ${{ inputs.packages }}
9893
archs: ${{ inputs.archs }}
9994
sbom-path: ${{ github.workspace }}/sbom
10095

10196
- id: digest
10297
shell: bash
10398
run: |
104-
echo "digest=$(crane digest ${{ inputs.registry }}/${{ inputs.image }}:${{ inputs.tag }})" >> $GITHUB_OUTPUT
99+
echo "digest=$(crane digest ${{ steps.vars.outputs.registry }}/${{ inputs.image }}:${{ inputs.tag }})" >> $GITHUB_OUTPUT
105100
if [[ "${{ inputs.archs }}" == *"amd64"* ]]; then
106-
echo "digest-amd64=$(crane digest --platform=linux/amd64 ${{ inputs.registry }}/${{ inputs.image }}:${{ inputs.tag }})" >> $GITHUB_OUTPUT
101+
echo "digest-amd64=$(crane digest --platform=linux/amd64 ${{ steps.vars.outputs.registry }}/${{ inputs.image }}:${{ inputs.tag }})" >> $GITHUB_OUTPUT
107102
else
108103
echo "digest-amd64=''" >> $GITHUB_OUTPUT
109104
fi
110105
if [[ "${{ inputs.archs }}" == *"arm64"* ]]; then
111-
echo "digest-arm64=$(crane digest --platform=linux/arm64 ${{ inputs.registry }}/${{ inputs.image }}:${{ inputs.tag }})" >> $GITHUB_OUTPUT
106+
echo "digest-arm64=$(crane digest --platform=linux/arm64 ${{ steps.vars.outputs.registry }}/${{ inputs.image }}:${{ inputs.tag }})" >> $GITHUB_OUTPUT
112107
else
113108
echo "digest-arm64=''" >> $GITHUB_OUTPUT
114109
fi
@@ -121,12 +116,13 @@ jobs:
121116
cosign sign \
122117
--recursive \
123118
--oidc-provider=github-actions \
124-
${{ inputs.registry }}/${{ inputs.image }}@${{ steps.digest.outputs.digest }}
119+
${{ steps.vars.outputs.registry }}/${{ inputs.image }}@${{ steps.digest.outputs.digest }}
125120
126-
- name: Attest provenance
121+
- if: steps.vars.outputs.registry == 'ghcr.io'
122+
name: Attest provenance
127123
uses: actions/attest-build-provenance@v2
128124
with:
129-
subject-name: ${{ inputs.registry }}/${{ inputs.image }}
125+
subject-name: ${{ steps.vars.outputs.registry }}/${{ inputs.image }}
130126
subject-digest: ${{ steps.digest.outputs.digest }}
131127
push-to-registry: true
132128

@@ -139,7 +135,7 @@ jobs:
139135
--type=spdxjson \
140136
--predicate=${{ github.workspace }}/sbom/sbom-index.spdx.json \
141137
--oidc-provider=github-actions \
142-
${{ inputs.registry }}/${{ inputs.image }}@${{ steps.digest.outputs.digest }}
138+
${{ steps.vars.outputs.registry }}/${{ inputs.image }}@${{ steps.digest.outputs.digest }}
143139
144140
- if: steps.digest.outputs.digest-amd64 != ''
145141
name: Attest amd64 SBOM
@@ -151,7 +147,7 @@ jobs:
151147
--type=spdxjson \
152148
--predicate=${{ github.workspace }}/sbom/sbom-x86_64.spdx.json \
153149
--oidc-provider=github-actions \
154-
${{ inputs.registry }}/${{ inputs.image }}@${{ steps.digest.outputs.digest-amd64 }}
150+
${{ steps.vars.outputs.registry }}/${{ inputs.image }}@${{ steps.digest.outputs.digest-amd64 }}
155151
156152
- if: steps.digest.outputs.digest-arm64 != ''
157153
name: Attest arm64 SBOM
@@ -163,14 +159,14 @@ jobs:
163159
--type=spdxjson \
164160
--predicate=${{ github.workspace }}/sbom/sbom-aarch64.spdx.json \
165161
--oidc-provider=github-actions \
166-
${{ inputs.registry }}/${{ inputs.image }}@${{ steps.digest.outputs.digest-arm64 }}
162+
${{ steps.vars.outputs.registry }}/${{ inputs.image }}@${{ steps.digest.outputs.digest-arm64 }}
167163
168164
- if: inputs.scan == 'true'
169165
name: Scan image
170166
id: scan
171167
uses: anchore/scan-action@v6
172168
with:
173-
image: ${{ inputs.registry }}/${{ inputs.image }}:${{ inputs.tag }}
169+
image: ${{ steps.vars.outputs.registry }}/${{ inputs.image }}:${{ inputs.tag }}
174170
cache-db: true
175171
fail-build: 'false'
176172
severity-cutoff: 'high'

‎images/minio-bitnami-client/prod.yaml‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
1-
include: images/apko.yaml
2-
31
contents:
2+
keyring:
3+
- https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
4+
repositories:
5+
- https://packages.wolfi.dev/os
46
packages:
57
- bash
68
- busybox
@@ -13,6 +15,22 @@ contents:
1315
- readline
1416
- wolfi-baselayout
1517

18+
accounts:
19+
groups:
20+
- groupname: nonroot
21+
gid: 65532
22+
users:
23+
- username: nonroot
24+
uid: 65532
25+
gid: 0
26+
run-as: nonroot
27+
28+
work-dir: /opt/bitnami/minio-client
29+
30+
archs:
31+
- amd64
32+
- arm64
33+
1634
entrypoint:
1735
command: /opt/bitnami/scripts/minio-client/entrypoint.sh
1836

@@ -22,6 +40,9 @@ environment:
2240
BITNAMI_APP_NAME: minio
2341

2442
annotations:
25-
org.opencontainers.image.title: 'minio-bitnami-client'
43+
org.opencontainers.image.authors: 'GitGuardian SRE Team <[email protected]>'
2644
org.opencontainers.image.description: 'MinIO-Bitnami client image based on Wolfi OS'
45+
org.opencontainers.image.licenses: 'MIT'
2746
org.opencontainers.image.source": 'https://github.com/GitGuardian/wolfi/tree/main/images/minio-bitnami-client'
47+
org.opencontainers.image.title: 'minio-bitnami-client'
48+
org.opencontainers.image.vendor: 'GitGuardian'

‎images/minio-bitnami/prod.yaml‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
1-
include: images/apko.yaml
2-
31
contents:
2+
keyring:
3+
- https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
4+
repositories:
5+
- https://packages.wolfi.dev/os
46
packages:
57
- bash
68
- bash-binsh
@@ -14,6 +16,22 @@ contents:
1416
- wait-for-port
1517
- wolfi-baselayout
1618

19+
accounts:
20+
groups:
21+
- groupname: nonroot
22+
gid: 65532
23+
users:
24+
- username: nonroot
25+
uid: 65532
26+
gid: 0
27+
run-as: nonroot
28+
29+
work-dir: /opt/bitnami/minio-client
30+
31+
archs:
32+
- amd64
33+
- arm64
34+
1735
entrypoint:
1836
command: /opt/bitnami/scripts/minio/entrypoint.sh
1937

@@ -23,6 +41,9 @@ environment:
2341
BITNAMI_APP_NAME: minio
2442

2543
annotations:
26-
org.opencontainers.image.title: 'minio-bitnami'
44+
org.opencontainers.image.authors: 'GitGuardian SRE Team <[email protected]>'
2745
org.opencontainers.image.description: 'MinIO-Bitnami image based on Wolfi OS'
46+
org.opencontainers.image.licenses: 'MIT'
2847
org.opencontainers.image.source": 'https://github.com/GitGuardian/wolfi/tree/main/images/minio-bitnami'
48+
org.opencontainers.image.title: 'minio-bitnami'
49+
org.opencontainers.image.vendor: 'GitGuardian'

0 commit comments

Comments
 (0)