Skip to content

Commit 9341f02

Browse files
chadlwilsonchadlwilson
authored
build: Build amd64 and arm64 multi-platform Docker image (#7952)
Signed-off-by: Chad Wilson <[email protected]>
1 parent 3bff5af commit 9341f02

File tree

8 files changed

+112
-33
lines changed

8 files changed

+112
-33
lines changed

‎.github/workflows/build.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,18 @@ jobs:
141141
uses: actions/download-artifact@v5
142142
with:
143143
name: archive-snapshot
144+
- name: Set up Docker
145+
uses: docker/setup-docker-action@v4
146+
with:
147+
daemon-config: |
148+
{
149+
"debug": true,
150+
"features": {
151+
"containerd-snapshotter": true
152+
}
153+
}
154+
- name: Set up Docker Buildx
155+
uses: docker/setup-buildx-action@v3
144156
- name: Build Docker Image
145157
run: ./build-docker.sh
146158
- name: build scan target

‎.github/workflows/pull_requests.yml‎

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,19 @@ jobs:
6464
with:
6565
sarif_file: core/target/spotbugsSarif.json
6666
category: spotbugs-core
67-
67+
- name: Archive Snapshot
68+
id: archive-snapshot
69+
uses: actions/upload-artifact@v4
70+
with:
71+
name: archive-snapshot
72+
retention-days: 1
73+
path: |
74+
**/target/*.asc
75+
**/target/*.jar
76+
**/target/*.pom
77+
ant/target/*.zip
78+
cli/target/*.zip
79+
6880
maven:
6981
name: Regression Test Maven Plugin
7082
permissions:
@@ -143,4 +155,45 @@ jobs:
143155
uses: github/codeql-action/upload-sarif@v3
144156
with:
145157
sarif_file: target/checkstyle-result.sarif
146-
category: checkstyle
158+
category: checkstyle
159+
160+
docker:
161+
permissions:
162+
contents: read # to fetch code (actions/checkout)
163+
164+
name: Build and Test Docker
165+
runs-on: ubuntu-latest
166+
needs: test
167+
steps:
168+
- name: Checkout code
169+
uses: actions/checkout@v5
170+
- name: Check Maven Cache
171+
id: maven-cache
172+
uses: actions/cache@v4
173+
with:
174+
path: ~/.m2/repository
175+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
176+
restore-keys: |
177+
${{ runner.os }}-maven-
178+
- name: Download release build
179+
uses: actions/download-artifact@v5
180+
with:
181+
name: archive-snapshot
182+
- name: Set up Docker
183+
uses: docker/setup-docker-action@v4
184+
with:
185+
daemon-config: |
186+
{
187+
"debug": true,
188+
"features": {
189+
"containerd-snapshotter": true
190+
}
191+
}
192+
- name: Set up Docker Buildx
193+
uses: docker/setup-buildx-action@v3
194+
- name: Build Docker Image
195+
run: ./build-docker.sh
196+
- name: build scan target
197+
run: mvn -V -s settings.xml package -DskipTests=true --no-transfer-progress --batch-mode
198+
- name: Test Docker Image
199+
run: ./test-docker.sh

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,18 @@ jobs:
149149
uses: actions/download-artifact@v5
150150
with:
151151
name: archive-release
152+
- name: Set up Docker
153+
uses: docker/setup-docker-action@v4
154+
with:
155+
daemon-config: |
156+
{
157+
"debug": true,
158+
"features": {
159+
"containerd-snapshotter": true
160+
}
161+
}
162+
- name: Set up Docker Buildx
163+
uses: docker/setup-buildx-action@v3
152164
- name: Build Docker Image
153165
run: ./build-docker.sh
154166
- name: build scan target

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ RUN apk update
4747
apk del .build-deps
4848

4949
### remove any suid sgid - we don't need them
50-
RUN find / -perm +6000 -type f -exec chmod a-s {} \;
50+
RUN find / -path /proc -prune -perm +6000 -type f -exec chmod a-s {} \;
5151
USER ${UID}
5252

5353
VOLUME ["/src", "/report"]

‎build-docker.sh‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,27 @@
1-
#!/bin/bash -e
1+
#!/bin/bash
2+
set -euo pipefail
23

34
VERSION=$(mvn -q \
45
-Dexec.executable="echo" \
56
-Dexec.args='${project.version}' \
67
--non-recursive \
7-
org.codehaus.mojo:exec-maven-plugin:1.3.1:exec)
8+
org.codehaus.mojo:exec-maven-plugin:3.5.1:exec)
89

910
FILE=./cli/target/dependency-check-$VERSION-release.zip
10-
if [ -f "$FILE" ]; then
11-
docker build . --build-arg VERSION=$VERSION -t owasp/dependency-check:$VERSION
12-
if [[ ! $VERSION = *"SNAPSHOT"* ]]; then
13-
docker tag owasp/dependency-check:$VERSION owasp/dependency-check:latest
14-
fi
15-
else
11+
if [ ! -f "$FILE" ]; then
1612
echo "$FILE does not exist - run 'mvn package' first"
1713
exit 1
1814
fi
15+
16+
if ! docker info -f '{{ .DriverStatus }}' | grep "driver-type io.containerd.snapshotter" >/dev/null; then
17+
echo "Docker Engine is not running with the containerd snapshotter - this is currently needed to build and test ODC multi-platform images using docker buildx."
18+
echo "If using Docker Desktop, enable \"Use containerd for pulling and storing images\" per https://docs.docker.com/desktop/settings-and-maintenance/settings/#general"
19+
echo "For more technical information on Docker Engine, see https://docs.docker.com/engine/storage/containerd/"
20+
exit 1
21+
fi
22+
23+
extra_tag_args="$([[ ! $VERSION = *"SNAPSHOT"* ]] && echo "--tag owasp/dependency-check:latest" || echo "")"
24+
25+
docker buildx build --pull --load --platform linux/amd64,linux/arm64 . \
26+
--build-arg VERSION=$VERSION \
27+
--tag owasp/dependency-check:$VERSION ${extra_tag_args}

‎publish-docker.sh‎

Lines changed: 8 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,15 @@ VERSION=$(mvn -q \
44
-Dexec.executable="echo" \
55
-Dexec.args='${project.version}' \
66
--non-recursive \
7-
org.codehaus.mojo:exec-maven-plugin:1.3.1:exec)
7+
org.codehaus.mojo:exec-maven-plugin:3.5.1:exec)
88

99
if [[ $VERSION = *"SNAPSHOT"* ]]; then
10-
echo "Do not publish a snapshot version of dependency-check"
11-
exit 1
12-
fi
13-
docker inspect --type=image owasp/dependency-check:$VERSION > /dev/null 2>&1
14-
if [[ "$?" -ne 0 ]] ; then
15-
echo "docker image owasp/dependency-check:$VERSION does not exist - run build_docker.sh first"
16-
exit 1
17-
fi
18-
docker inspect --type=image owasp/dependency-check:latest > /dev/null 2>&1
19-
if [[ "$?" -ne 0 ]] ; then
20-
echo "docker image owasp/dependency-check:latest does not exist - run build_docker.sh first"
21-
exit 1
10+
echo "Do not publish a snapshot version of dependency-check"
11+
exit 1
2212
fi
2313

24-
docker push owasp/dependency-check:$VERSION
25-
docker push owasp/dependency-check:latest
14+
# Build args should match ./build-docker.sh so the builder cache is re-used
15+
docker buildx build --push --platform linux/amd64,linux/arm64 . \
16+
--build-arg VERSION=$VERSION \
17+
--tag owasp/dependency-check:$VERSION \
18+
--tag owasp/dependency-check:latest

‎shell-docker.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ VERSION=$(mvn -q \
44
-Dexec.executable="echo" \
55
-Dexec.args='${project.version}' \
66
--non-recursive \
7-
org.codehaus.mojo:exec-maven-plugin:1.3.1:exec)
7+
org.codehaus.mojo:exec-maven-plugin:3.5.1:exec)
88

99
SCAN_TARGET="./cli/target/release/lib"
1010

‎test-docker.sh‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ VERSION=$(mvn -q \
44
-Dexec.executable="echo" \
55
-Dexec.args='${project.version}' \
66
--non-recursive \
7-
org.codehaus.mojo:exec-maven-plugin:1.3.1:exec)
7+
org.codehaus.mojo:exec-maven-plugin:3.5.1:exec)
88

99
SCAN_TARGET="./cli/target/release/lib"
1010

1111
if [ ! -d "$SCAN_TARGET" ]; then
12-
echo "Scan target does not exist: $SCAN_TARGET"
13-
exit 1
12+
echo "Scan target does not exist: $SCAN_TARGET"
13+
exit 1
1414
fi
1515

1616
if [ -f "$HOME/OWASP-Dependency-Check/reports/dependency-check-report.json" ]; then
@@ -73,8 +73,8 @@ cd -
7373
echo ""
7474
grep -oF "dependency-check-core-$VERSION.jar" $HOME/OWASP-Dependency-Check/reports/dependency-check-report.json > /dev/null 2>&1
7575
if [[ "$?" -eq 0 ]] ; then
76-
echo "SUCCESS - dependency-check docker test passed"
76+
echo "SUCCESS - dependency-check docker test passed"
7777
else
78-
echo "FAILED - dependency-check docker test failed"
79-
exit 1
78+
echo "FAILED - dependency-check docker test failed"
79+
exit 1
8080
fi

0 commit comments

Comments
 (0)