Skip to content

Commit 9dcc3f2

Browse files
anthony-nhsanthony-nhs
committed
build macos on seperate image
1 parent 5666353 commit 9dcc3f2

File tree

2 files changed

+224
-3
lines changed

2 files changed

+224
-3
lines changed

‎.github/scripts/check_ecr_image_scan_results.sh‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
#!/usr/bin/env bash
2+
set -e
3+
4+
AWS_MAX_ATTEMPTS=20
5+
export AWS_MAX_ATTEMPTS
6+
7+
if [ -z "${REPOSITORY_NAME}" ]; then
8+
echo "REPOSITORY_NAME not set"
9+
exit 1
10+
fi
11+
12+
if [ -z "${IMAGE_TAG}" ]; then
13+
echo "IMAGE_TAG not set"
14+
exit 1
15+
fi
16+
17+
if [ -z "${AWS_REGION}" ]; then
18+
echo "AWS_REGION not set"
19+
exit 1
20+
fi
21+
22+
if [ -z "${ACCOUNT_ID}" ]; then
23+
echo "AWS_REGION not set"
24+
exit 1
25+
fi
26+
27+
IMAGE_DIGEST=$(aws ecr describe-images \
28+
--repository-name "$REPOSITORY_NAME" \
29+
--image-ids imageTag="$IMAGE_TAG" \
30+
--query 'imageDetails[0].imageDigest' \
31+
--output text)
32+
33+
RESOURCE_ARN="arn:aws:ecr:${AWS_REGION}:${ACCOUNT_ID}:repository/${REPOSITORY_NAME}/${IMAGE_DIGEST}"
34+
35+
echo "Monitoring scan for ${REPOSITORY_NAME}:${IMAGE_TAG}"
36+
echo "Resource ARN: ${RESOURCE_ARN}"
37+
echo
38+
39+
# Wait for ECR scan to reach COMPLETE
40+
STATUS=""
41+
echo "Waiting for ECR scan to complete..."
42+
for i in {1..30}; do
43+
echo "Checking scan status. Attempt ${i}"
44+
STATUS=$(aws ecr describe-image-scan-findings \
45+
--repository-name "$REPOSITORY_NAME" \
46+
--image-id imageDigest="$IMAGE_DIGEST" \
47+
--query 'imageScanStatus.status' \
48+
--output text 2>/dev/null || echo "NONE")
49+
50+
if [[ "$STATUS" == "COMPLETE" ]]; then
51+
echo "ECR scan completed."
52+
break
53+
fi
54+
55+
if [[ "$STATUS" == "FAILED" ]]; then
56+
echo "Scan failed."
57+
exit 1
58+
fi
59+
60+
echo "SCAN IS NOT YET COMPLETE. Waiting 10 seconds before checking again..."
61+
sleep 10
62+
done
63+
64+
if [[ "$STATUS" != "COMPLETE" ]]; then
65+
echo "Timeout waiting for ECR scan to complete."
66+
exit 1
67+
fi
68+
69+
# Wait for Inspector2 findings to appear & stabilize
70+
# this is in place as scan may show as complete but findings have not yet stabilize
71+
echo
72+
echo "Waiting for Inspector2 findings to stabilize..."
73+
74+
PREV_HASH=""
75+
for i in {1..12}; do # ~2 minutes max
76+
FINDINGS=$(aws inspector2 list-findings \
77+
--filter-criteria "{
78+
\"resourceId\": [{\"comparison\": \"EQUALS\", \"value\": \"${RESOURCE_ARN}\"}],
79+
\"findingStatus\": [{\"comparison\": \"EQUALS\", \"value\": \"ACTIVE\"}]
80+
}" \
81+
--output json 2>/dev/null || echo "{}")
82+
83+
CURR_HASH=$(echo "$FINDINGS" | sha256sum)
84+
COUNT=$(echo "$FINDINGS" | jq '.findings | length')
85+
86+
if [[ "$COUNT" -gt 0 && "$CURR_HASH" == "$PREV_HASH" ]]; then
87+
echo "Findings stabilized ($COUNT findings)."
88+
break
89+
fi
90+
91+
PREV_HASH="$CURR_HASH"
92+
echo "Attempt: ${i}. Still waiting... (${COUNT} findings so far)"
93+
sleep 10
94+
done
95+
96+
# Extract counts and display findings
97+
echo
98+
echo "Final Inspector2 findings with suppressions removed:"
99+
echo
100+
101+
echo "$FINDINGS" | jq '{
102+
findings: [
103+
.findings[]? | {
104+
severity: .severity,
105+
title: .title,
106+
package: .packageVulnerabilityDetails.vulnerablePackages[0].name,
107+
sourceUrl: .packageVulnerabilityDetails.sourceUrl,
108+
recommendation: (.remediation.recommendation.text // "N/A")
109+
}
110+
]
111+
}'
112+
113+
echo
114+
115+
# Check for critical/high severity
116+
CRITICAL_COUNT=$(echo "$FINDINGS" | jq '[.findings[]? | select(.severity=="CRITICAL")] | length')
117+
HIGH_COUNT=$(echo "$FINDINGS" | jq '[.findings[]? | select(.severity=="HIGH")] | length')
118+
119+
if (( CRITICAL_COUNT > 0 || HIGH_COUNT > 0 )); then
120+
echo "${CRITICAL_COUNT} CRITICAL and ${HIGH_COUNT} HIGH vulnerabilities detected!"
121+
echo
122+
echo "Critical/High vulnerabilities:"
123+
echo "$FINDINGS" | jq -r '
124+
.findings[]? |
125+
select(.severity=="CRITICAL" or .severity=="HIGH") |{
126+
severity: .severity,
127+
title: .title,
128+
package: .packageVulnerabilityDetails.vulnerablePackages[0].name,
129+
sourceUrl: .packageVulnerabilityDetails.sourceUrl,
130+
recommendation: (.remediation.recommendation.text // "N/A")
131+
}'
132+
echo
133+
echo "Failing pipeline due to Critical/High vulnerabilities."
134+
exit 2
135+
else
136+
echo "No Critical or High vulnerabilities found."
137+
exit 0
138+
fi

‎.github/workflows/quality-checks.yml‎

Lines changed: 86 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55
secrets:
66
SONAR_TOKEN:
77
required: false
8+
CLOUD_FORMATION_DEPLOY_ROLE:
9+
required: false
810
inputs:
911
install_java:
1012
type: boolean
@@ -23,6 +25,14 @@ on:
2325
type: boolean
2426
description: Toggle to reinstall poetry on top of python version installed by asdf.
2527
default: false
28+
dev_container_ecr:
29+
type: string
30+
description: "The name of the ECR repository to push the dev container image to."
31+
required: false
32+
dev_container_image_tag:
33+
type: string
34+
description: "The tag to use for the dev container image."
35+
required: false
2636
jobs:
2737
quality_checks:
2838
runs-on: ubuntu-22.04
@@ -357,7 +367,7 @@ jobs:
357367
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
358368
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
359369

360-
build_dev_container:
370+
build_dev_container_x64:
361371
runs-on: ubuntu-22.04
362372
steps:
363373
- name: Checkout code
@@ -368,5 +378,78 @@ jobs:
368378

369379
- name: Build dev container
370380
run: |
371-
docker buildx create --use
372-
docker buildx build --platform linux/amd64,linux/arm64 -f .devcontainer/Dockerfile -t dev-container-image .
381+
docker build -f .devcontainer/Dockerfile -t dev-container-image .
382+
# - name: Configure AWS Credentials
383+
# uses: aws-actions/configure-aws-credentials@v5
384+
# id: connect-aws-deploy
385+
# with:
386+
# aws-region: eu-west-2
387+
# role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
388+
# role-session-name: dev-container-build
389+
# output-credentials: true
390+
391+
# - name: Retrieve AWS Account ID
392+
# id: retrieve-deploy-account-id
393+
# run: echo "ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_ENV"
394+
395+
# - name: Login to Amazon ECR
396+
# id: login-ecr-push-image
397+
# run: |
398+
# aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ env.ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com
399+
400+
# - name: Push FHIR Facade image to Amazon ECR
401+
# run: |
402+
# docker tag "dev-container-image" "${{ env.ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com/${{inputs.DEV_CONTAINER_ECR}}:${{ inputs.DEV_CONTAINER_IMAGE_TAG }}"
403+
# docker push "${{ env.ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com/${{inputs.DEV_CONTAINER_ECR}}:${{ inputs.DEV_CONTAINER_IMAGE_TAG }}"
404+
405+
# - name: Check dev container scan results
406+
# env:
407+
# REPOSITORY_NAME: ${{inputs.DEV_CONTAINER_ECR}}
408+
# IMAGE_TAG: ${{ inputs.DEV_CONTAINER_IMAGE_TAG }}
409+
# working-directory: .github/scripts
410+
# run: |
411+
# ./check_ecr_image_scan_results.sh
412+
413+
build_dev_container_arm64:
414+
runs-on: macos-latest
415+
steps:
416+
- name: Checkout code
417+
uses: actions/checkout@v5
418+
with:
419+
ref: ${{ env.BRANCH_NAME }}
420+
fetch-depth: 0
421+
422+
- name: Build dev container
423+
run: |
424+
docker build -f .devcontainer/Dockerfile -t dev-container-image .
425+
426+
# - name: Configure AWS Credentials
427+
# uses: aws-actions/configure-aws-credentials@v5
428+
# id: connect-aws-deploy
429+
# with:
430+
# aws-region: eu-west-2
431+
# role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
432+
# role-session-name: dev-container-build
433+
# output-credentials: true
434+
435+
# - name: Retrieve AWS Account ID
436+
# id: retrieve-deploy-account-id
437+
# run: echo "ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_ENV"
438+
439+
# - name: Login to Amazon ECR
440+
# id: login-ecr-push-image
441+
# run: |
442+
# aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ env.ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com
443+
444+
# - name: Push FHIR Facade image to Amazon ECR
445+
# run: |
446+
# docker tag "dev-container-image" "${{ env.ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com/${{inputs.DEV_CONTAINER_ECR}}:${{ inputs.DEV_CONTAINER_IMAGE_TAG }}"
447+
# docker push "${{ env.ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com/${{inputs.DEV_CONTAINER_ECR}}:${{ inputs.DEV_CONTAINER_IMAGE_TAG }}"
448+
449+
# - name: Check dev container scan results
450+
# env:
451+
# REPOSITORY_NAME: ${{inputs.DEV_CONTAINER_ECR}}
452+
# IMAGE_TAG: ${{ inputs.DEV_CONTAINER_IMAGE_TAG }}
453+
# working-directory: .github/scripts
454+
# run: |
455+
# ./check_ecr_image_scan_results.sh

0 commit comments

Comments
 (0)