Merge pull request #1 from ZachChuba/core-vulns

Core vulns

Author: ZachChuba

.devcontainer/devcontainer.json

@@ -1,23 +1,13 @@
 // For format details, see https://aka.ms/devcontainer.json. For config options, see the README at:
 // https://github.com/microsoft/vscode-dev-containers/tree/v0.241.1/containers/java-8
 {
-	"name": "Java 8",
-    "image": "mcr.microsoft.com/devcontainers/java:1-8-bullseye",
+	"name": "Java 17",
+    "image": "mcr.microsoft.com/devcontainers/java:0-17",
 
 	// Configure tool-specific properties.
 	"customizations": {
 		// Configure properties specific to VS Code.
 		"vscode": {
-			// Set *default* container specific settings.json values on container create.
-			"settings": {
-				"java.import.gradle.java.home": "/usr/local/sdkman/candidates/java/current",
-				"java.configuration.runtimes": [{
-					"default": true,
-					"name": "JavaSE-1.8",
-					"path": "/usr/local/sdkman/candidates/java/current"
-				}]
-			},
-
 			// Add the IDs of extensions you want installed when the container is created.
 			"extensions": [
 				"vscjava.vscode-java-pack"

.github/actions/setup-build/action.yml

@@ -1,9 +1,16 @@
 name: Set up Build
 description: Sets up Build
+inputs:
+  java-version:
+    description: 'The Java version to set up'
+    required: true
+    default: '17'
 runs:
   using: "composite"
   steps:
     - uses: ./.github/actions/setup-java
+      with:
+        java-version: ${{ inputs.java-version }}
     - name: Clear existing docker image cache
       shell: bash
       run: docker image prune -af

.github/actions/setup-gradle/action.yml

@@ -4,10 +4,9 @@ runs:
   using: "composite"
   steps:
     - name: Setup Gradle Build Action
-      uses: gradle/actions/setup-gradle@v3
+      uses: gradle/actions/setup-gradle@v4
       with:
         gradle-home-cache-includes: |
           caches
           notifications
           jdks
-        gradle-home-cache-cleanup: true

.github/actions/setup-java/action.yml

@@ -1,9 +1,14 @@
 name: Set up Java
 description: Sets up Java version
+inputs:
+  java-version:
+    description: 'The Java version to set up'
+    required: true
+    default: '17'
 runs:
   using: "composite"
   steps:
     - uses: actions/setup-java@v4
       with:
-        java-version: '8'
+        java-version: ${{ inputs.java-version }}
         distribution: temurin

.github/settings.yml

@@ -400,7 +400,7 @@ branches:
         # Required. Require branches to be up to date before merging.
         strict: true
         # Required. The list of status checks to require in order to merge into this branch
-        contexts: ["core", "check_docs_examples (:docs:examples:check)", "in-docker_test", "ci/circleci: minimal_core", "test"]
+        contexts: ["core (17)", "core (21)", "check_docs_examples (:docs:examples:check)", "in-docker_test", "ci/circleci: minimal_core", "test"]
       # Required. Enforce all configured restrictions for administrators. Set to true to enforce required status checks for repository administrators. Set to null to disable.
       enforce_admins: false
       # Prevent merge commits from being pushed to matching branches

.github/workflows/ci-docker-wormhole.yml

@@ -53,5 +53,5 @@ jobs:
             -v "$PWD:$PWD" \
             -w "$PWD" \
             -e AUTO_APPLY_GIT_HOOKS=false \
-            openjdk:8-jdk-alpine \
+            eclipse-temurin:17-jdk-alpine \
             ./gradlew --no-daemon --continue --scan testcontainers:test --tests '*GenericContainerRuleTest'

.github/workflows/ci-rootless.yml

@@ -48,11 +48,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup rootless Docker
-        uses: ScribeMD/rootless-docker@0.2.2
-      - name: Remove Docket root socket
-        run: sudo rm -rf /var/run/docker.sock
+        uses: docker/setup-docker-action@v4
+        with:
+          rootless: true
       - name: Setup Gradle Build Action
-        uses: gradle/actions/setup-gradle@v3
+        uses: gradle/actions/setup-gradle@v4
       - name: Build with Gradle
         run: ./gradlew --no-daemon --scan testcontainers:test --tests '*GenericContainerRuleTest'
       - uses: ./.github/actions/setup-junit-report

.github/workflows/ci-windows.yml

@@ -53,6 +53,7 @@ jobs:
       checks: write
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-build
       - name: Build with Gradle
         run: ./gradlew.bat cleanTest testcontainers:test --no-daemon --continue --scan --no-build-cache
       - uses: ./.github/actions/setup-junit-report
@@ -82,6 +83,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
           ref: ${{ github.event.client_payload.pull_request.head.ref }}
+      - uses: ./.github/actions/setup-build
       - name: Build with Gradle
         run: ./gradlew.bat cleanTest testcontainers:test --no-daemon --continue --scan --no-build-cache
       - uses: ./.github/actions/setup-junit-report

.github/workflows/ci.yml

@@ -50,9 +50,14 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       checks: write
+    strategy:
+      matrix:
+        java: [ '17', '21' ]
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-build
+        with:
+          java-version: ${{ matrix.java }}
       - name: Build and test with Gradle
         run: |
           ./gradlew :testcontainers:check --no-daemon --continue --scan
@@ -86,7 +91,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-java
       - name: Setup Gradle Build Action
-        uses: gradle/actions/setup-gradle@v3
+        uses: gradle/actions/setup-gradle@v4
       - id: set-matrix
         env:
           # Since we override the tests executor,
@@ -121,7 +126,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-java
       - name: Setup Gradle Build Action
-        uses: gradle/actions/setup-gradle@v3
+        uses: gradle/actions/setup-gradle@v4
       - id: set-matrix
         working-directory: ./examples/
         env:
@@ -158,7 +163,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-java
       - name: Setup Gradle Build Action
-        uses: gradle/actions/setup-gradle@v3
+        uses: gradle/actions/setup-gradle@v4
       - id: set-matrix
         env:
           # Since we override the tests executor,

.github/workflows/moby-latest.yml

@@ -13,35 +13,31 @@ jobs:
   test_docker:
     strategy:
       matrix:
-        install-docker-type: ["STABLE", "ROOTLESS", "ROOTFUL"]
-    name: "Core tests using Docker ${{ matrix.install-docker-type }}"
+        include:
+          - { install-docker-type: "STABLE", channel: stable, rootless: false }
+          - { install-docker-type: "ROOTLESS", channel: stable, rootless: true }
+          - { install-docker-type: "ROOTFUL", channel: test, rootless: false }
+    name: "Core tests using Docker ${{ matrix.install-docker-type }} (channel ${{ matrix.channel }})"
     runs-on: ubuntu-22.04
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-build
 
       - name: Install Stable Docker
-        if: ${{ matrix.install-docker-type == 'STABLE' }}
-        run: curl https://get.docker.com
-
-      - name: Install Docker from the TEST channel
-        if: ${{ matrix.install-docker-type == 'ROOTFUL' }}
-        run: curl https://get.docker.com | CHANNEL=test sh
-
-      - name: Setup rootless Docker
-        if: ${{ matrix.install-docker-type == 'ROOTLESS' }}
-        uses: ScribeMD/rootless-docker@6bd157a512c2fafa4e0243a8aa87d964eb890886  # v0.2.2
-
-      - name: Remove Docker root socket
-        if: ${{ matrix.install-docker-type == 'ROOTLESS' }}
-        run: sudo rm -rf /var/run/docker.sock
+        id: setup_docker
+        uses: docker/setup-docker-action@v4
+        with:
+          channel: ${{ matrix.channel }}
+          rootless: ${{ matrix.rootless }}
 
       - name: Check Docker version
         run: docker version
 
       - name: Build with Gradle
         run: ./gradlew cleanTest --no-daemon --continue --scan -Dscan.tag.DOCKER_${{ matrix.install-docker-type }} testcontainers:test -Dorg.gradle.caching=false
+        env:
+          DOCKER_HOST: ${{steps.setup_docker.outputs.sock}}
       - uses: ./.github/actions/setup-junit-report
 
       - name: Notify to Slack on failures