Skip to content

Commit 57cd653

Browse files
anthony-nhsanthony-nhs
authored
New: [AEA-0000] - build image (#1)
1 parent c688c70 commit 57cd653

30 files changed

+14093
-0
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
FROM mcr.microsoft.com/devcontainers/base:ubuntu
2+
3+
RUN apt-get update \
4+
&& export DEBIAN_FRONTEND=noninteractive \
5+
&& apt-get -y dist-upgrade \
6+
&& apt-get -y install --no-install-recommends htop vim curl git build-essential \
7+
libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev libbz2-dev \
8+
zlib1g-dev unixodbc unixodbc-dev libsecret-1-0 libsecret-1-dev libsqlite3-dev \
9+
jq apt-transport-https ca-certificates gnupg-agent \
10+
software-properties-common bash-completion python3-pip make libbz2-dev \
11+
libreadline-dev libsqlite3-dev wget llvm libncurses5-dev libncursesw5-dev \
12+
xz-utils tk-dev liblzma-dev netcat libyaml-dev
13+
14+
# install aws stuff
15+
RUN wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" && \
16+
unzip /tmp/awscliv2.zip -d /tmp/aws-cli && \
17+
/tmp/aws-cli/aws/install && \
18+
rm tmp/awscliv2.zip && \
19+
rm -rf /tmp/aws-cli
20+
21+
USER vscode
22+
23+
# Install ASDF
24+
RUN git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.14.1; \
25+
echo '. $HOME/.asdf/asdf.sh' >> ~/.bashrc; \
26+
echo '. $HOME/.asdf/completions/asdf.bash' >> ~/.bashrc;
27+
28+
ENV PATH="$PATH:/home/vscode/.asdf/bin/:/workspaces/eps-cdk-utils/node_modules/.bin"
29+
30+
# Install ASDF plugins
31+
RUN asdf plugin add python; \
32+
asdf plugin add poetry https://github.com/asdf-community/asdf-poetry.git; \
33+
asdf plugin add shellcheck https://github.com/luizm/asdf-shellcheck.git; \
34+
asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git; \
35+
asdf plugin add direnv; \
36+
asdf plugin add actionlint;
37+
38+
WORKDIR /workspaces/eps-workflow-quality-checks
39+
40+
ADD .tool-versions /workspaces/eps-cdk-utils/.tool-versions
41+
ADD .tool-versions /home/vscode/.tool-versions
42+
43+
RUN asdf install; \
44+
asdf reshim python; \
45+
asdf reshim poetry; \
46+
asdf reshim nodejs; \
47+
asdf direnv setup --shell bash --version 2.32.2;

‎.devcontainer/devcontainer.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
2+
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
3+
{
4+
"name": "Ubuntu",
5+
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
6+
"build": {
7+
"dockerfile": "Dockerfile",
8+
"context": "..",
9+
"args": {}
10+
},
11+
"mounts": [
12+
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
13+
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",
14+
"source=${env:HOME}${env:USERPROFILE}/.gnupg,target=/home/vscode/.gnupg,type=bind",
15+
"source=${env:HOME}${env:USERPROFILE}/.npmrc,target=/home/vscode/.npmrc,type=bind"
16+
],
17+
"features": {
18+
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
19+
"version": "latest",
20+
"moby": "true",
21+
"installDockerBuildx": "true"
22+
}
23+
},
24+
"containerUser": "vscode",
25+
"customizations": {
26+
"vscode": {
27+
"extensions": [
28+
"AmazonWebServices.aws-toolkit-vscode",
29+
"redhat.vscode-yaml",
30+
"eamodio.gitlens",
31+
"github.vscode-pull-request-github",
32+
"streetsidesoftware.code-spell-checker",
33+
"timonwong.shellcheck",
34+
"github.vscode-github-actions"
35+
],
36+
"settings": {
37+
"cSpell.words": ["fhir", "Formik", "pino", "serialisation"]
38+
}
39+
}
40+
}
41+
}

‎.github/dependabot.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#########################################################################
2+
# Dependabot configuration file
3+
#########################################################################
4+
5+
version: 2
6+
updates:
7+
- package-ecosystem: "github-actions"
8+
# Workflow files stored in the
9+
# default location of `.github/workflows`
10+
directory: "/"
11+
schedule:
12+
interval: "daily"
13+
commit-message:
14+
prefix: "Upgrade: [dependabot] - "
15+
16+
###################################
17+
# NPM workspace ##################
18+
###################################
19+
- package-ecosystem: "npm"
20+
directory: "/"
21+
schedule:
22+
interval: "daily"
23+
versioning-strategy: increase
24+
open-pull-requests-limit: 20
25+
commit-message:
26+
prefix: "Upgrade: [dependabot] - "
27+
28+
###################################
29+
# Poetry #########################
30+
###################################
31+
- package-ecosystem: "pip"
32+
directory: "/"
33+
schedule:
34+
interval: "daily"
35+
versioning-strategy: increase
36+
commit-message:
37+
prefix: "Upgrade: [dependabot] - "

‎.github/pull_request_template.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
## Summary
2+
3+
**Remove items from this list if they are not relevant. Remove this line once this has been done**
4+
5+
- Routine Change
6+
- :exclamation: Breaking Change
7+
- :robot: Operational or Infrastructure Change
8+
- :sparkles: New Feature
9+
- :warning: Potential issues that might be caused by this change
10+
11+
### Details
12+
13+
Add any summary information of what is in the change. **Remove this line if you have nothing to add.**
14+
15+
## Pull Request Naming
16+
17+
Pull requests should be named using the following format:
18+
19+
```text
20+
Tag: [AEA-NNNN] - Short description
21+
```
22+
23+
Tag can be one of:
24+
25+
- `Fix` - for a bug fix. (Patch release)
26+
- `Update` - either for a backwards-compatible enhancement or for a rule change that adds reported problems. (Patch release)
27+
- `New` - implemented a new feature. (Minor release)
28+
- `Breaking` - for a backwards-incompatible enhancement or feature. (Major release)
29+
- `Docs` - changes to documentation only. (Patch release)
30+
- `Build` - changes to build process only. (No release)
31+
- `Upgrade` - for a dependency upgrade. (Patch release)
32+
- `Chore` - for refactoring, adding tests, etc. (anything that isn't user-facing). (Patch release)
33+
34+
If the current release is x.y.z then
35+
- a patch release increases z by 1
36+
- a minor release increases y by 1
37+
- a major release increases x by 1
38+
39+
Correct tagging is necessary for our automated versioning and release process.
40+
41+
The description of your pull request will be used as the commit message for the merge, and also be included in the changelog. Please ensure that your title is sufficiently descriptive.
42+
43+
### Rerunning Checks
44+
45+
If you need to rename your pull request, you can restart the checks by either:
46+
47+
- Closing and reopening the pull request
48+
- pushing an empty commit
49+
```bash
50+
git commit --allow-empty -m 'trigger build'
51+
git push
52+
```
53+
- Amend your last commit and force push to the branch
54+
```bash
55+
git commit --amend --no-edit
56+
git push --force
57+
```
58+
59+
Rerunning the checks from within the pull request will not use the updated title.

‎.github/scripts/check_ecr_image_scan_results.sh‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#!/bin/bash
2+
3+
if [ -z "${REPOSITORY_NAME}" ]; then
4+
echo "REPOSITORY_NAME not set"
5+
exit 1
6+
fi
7+
8+
if [ -z "${IMAGE_TAG}" ]; then
9+
echo "IMAGE_TAG not set"
10+
exit 1
11+
fi
12+
13+
function wait_for_scan() {
14+
echo "Giving some time for scan to begin..."
15+
sleep 3
16+
while [[ $(aws ecr describe-image-scan-findings --repository-name "${REPOSITORY_NAME}" --image-id imageTag="${IMAGE_TAG}" | jq -r .imageScanStatus.status) != "COMPLETE" ]];do
17+
echo "SCAN IS NOT YET COMPLETE..."
18+
sleep 3
19+
done
20+
}
21+
22+
function check_for_high_critical_vuln() {
23+
scan_results=$(aws ecr describe-image-scan-findings --repository-name "${REPOSITORY_NAME}" --image-id imageTag="${IMAGE_TAG}")
24+
high=$(echo "$scan_results" | jq .imageScanFindings.findingSeverityCounts.HIGH)
25+
critical=$(echo "$scan_results" | jq .imageScanFindings.findingSeverityCounts.CRITICAL)
26+
}
27+
28+
function return_scan_results() {
29+
echo "=== BEGIN IMAGE SCAN RESULTS ==="
30+
echo "$scan_results"
31+
echo "=== END IMAGE SCAN RESULTS ==="
32+
}
33+
34+
function return_error() {
35+
echo -e "\n**********************************************************"
36+
echo "**********************************************************"
37+
echo "**********************************************************"
38+
echo "ERROR: There are CRITICAL/HIGH vulnerabilties. Stopping build."
39+
echo "**********************************************************"
40+
echo "**********************************************************"
41+
echo "**********************************************************"
42+
exit 2
43+
}
44+
45+
function analyze_scan_results() {
46+
if [[ $critical -gt 0 ]]; then
47+
echo "ERROR: There are CRITICAL vulnerabilties. Stopping build."
48+
return_scan_results
49+
return_error
50+
elif [[ $high -gt 0 ]]; then
51+
echo "ERROR: There are HIGH vulnerabilties. Stopping build."
52+
return_scan_results
53+
return_error
54+
else
55+
return_scan_results
56+
fi
57+
}
58+
59+
wait_for_scan
60+
check_for_high_critical_vuln
61+
analyze_scan_results

0 commit comments

Comments
 (0)