diff --git a/.custom-gatecheck.yml b/.custom-gatecheck.yml deleted file mode 100644 index d806e07..0000000 --- a/.custom-gatecheck.yml +++ /dev/null @@ -1,22 +0,0 @@ -version: "1" -gitleaks: - limitEnabled: false -grype: - epssRiskAcceptance: - enabled: true - score: 0.001 - severityLimit: - critical: - enabled: true - limit: 0 - high: - enabled: true - limit: 7 -semgrep: - impactRiskAcceptance: - enabled: true - low: true - severityLimit: - error: - enabled: true - limit: 5 diff --git a/.gatecheck.yml b/.gatecheck.yml index eba79ed..3b3aac2 100644 --- a/.gatecheck.yml +++ b/.gatecheck.yml @@ -6,3 +6,27 @@ grype: cves: # Grype mis-reports this vulnerability which was fixed in clamav >= 0.99.0 even though the apk installed version is >= 1.2.2 - id: CVE-2016-1405 + # Docker CLI issue only affects Windows + - id: CVE-2025-15558 + # Docker Buildx plugin issue (in grpc lib), would only effect a server, we are only using the CLI as a client. + - id: CVE-2026-33186 + # Docker Buildx plugin issue (in opentelementry lib). Not exploitable. + - id: CVE-2026-24051 + # Docker Buildx plugin issue (in buildkit). Not exploitable since we aren't running or exposing the Buildkit daemon. + - id: CVE-2026-33748 + - id: CVE-2026-34040 + # No fix available + - id: CVE-2026-2673 + - id: CVE-2026-27135 + +semgrep: + impactRiskAcceptance: + enabled: true + low: true + severityLimit: + error: + # Do not error on semgrep findings. There is currently no way to ignore specific semgrep rules or finding instances. + enabled: false + warning: + enabled: true + limit: 0 diff --git a/.github/workflows/delivery.yaml b/.github/workflows/delivery.yaml index 56e6d75..c930a40 100644 --- a/.github/workflows/delivery.yaml +++ b/.github/workflows/delivery.yaml @@ -33,13 +33,9 @@ jobs: - arch: 'arm64' runs-on: ubuntu-24.04-arm - name: Build, Scan and Publish Images for ${{ matrix.arch }} + name: Build, Scan, and Publish Images for ${{ matrix.arch }} runs-on: ${{ matrix.runs-on }} steps: - # This is needed until we have multi-arch containers for all the steps - - name: Set up QEMU - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - - name: Set up Docker Buildx uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 with: @@ -49,7 +45,7 @@ jobs: uses: actions/cache@v5 with: path: ${{ runner.temp }}/.docker-cache - key: ${{ runner.os }}-docker-cache + key: ${{ runner.os }}-${{ matrix.arch }}-docker-cache - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 with: @@ -77,39 +73,39 @@ jobs: echo "git_commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT echo "git_description=$(git log -1 --pretty=%B | head -n 1 | tr \' _)" >> $GITHUB_OUTPUT - - name: Build and push - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 + - name: Build, Scan, and Publish Images (Docker CLI) + uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@buildkit-debug with: - platforms: linux/${{ matrix.arch }} - push: true - tags: ${{ steps.vars.outputs.image_name }} - cache-from: "type=local,src=${{ runner.temp }}/.docker-cache" - cache-to: "type=local,dest=${{ runner.temp }}/.docker-cache,mode=max" - build-args: "VERSION=${{ steps.vars.outputs.version }},GIT_COMMIT=${{ steps.vars.outputs.git_commit }},GIT_DESCRIPTION=${{ steps.vars.outputs.git_description }}" + platform: linux/${{ matrix.arch }} + tag: ${{ steps.vars.outputs.image_name }} + build_args: "VERSION=${{ steps.vars.outputs.version }},GIT_COMMIT=${{ steps.vars.outputs.git_commit }},GIT_DESCRIPTION=${{ steps.vars.outputs.git_description }}" + image_build_cache_from: "type=local,src=${{ runner.temp }}/.docker-cache" + image_build_cache_to: "type=local,dest=${{ runner.temp }}/.docker-cache,mode=max" + deploy_enabled: true - - name: Build and push podman target - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 + - name: Build, Scan, and Publish Images (Podman CLI) + uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@buildkit-debug with: - platforms: linux/${{ matrix.arch }} - push: true - tags: ${{ steps.vars.outputs.podman_image_name }} - build-args: "VERSION=${{ steps.vars.outputs.version }},GIT_COMMIT=${{ steps.vars.outputs.git_commit }},GIT_DESCRIPTION=${{ steps.vars.outputs.git_description }}" + platform: linux/${{ matrix.arch }} + tag: ${{ steps.vars.outputs.podman_image_name }} target: portage-podman - - - name: Run Portage CD Scans - uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@main - with: - image_build_enabled: false - image_publish_enabled: false - tag: ${{ steps.vars.outputs.image_name }} - maximum_vulnerability_db_age: "1440h" + build_args: "VERSION=${{ steps.vars.outputs.version }},GIT_COMMIT=${{ steps.vars.outputs.git_commit }},GIT_DESCRIPTION=${{ steps.vars.outputs.git_description }}" + image_build_cache_from: "type=local,src=${{ runner.temp }}/.docker-cache" + image_build_cache_to: "type=local,dest=${{ runner.temp }}/.docker-cache,mode=max" + deploy_enabled: true - name: Store Artifacts + if: always() uses: actions/upload-artifact@v7 with: name: build-artifacts-${{ matrix.arch }} path: artifacts/ + - name: Push Docker Images + run: | + docker push ${{ steps.vars.outputs.image_name }} + docker push ${{ steps.vars.outputs.podman_image_name }} + - name: job summary shell: bash run: | @@ -137,18 +133,11 @@ jobs: IMAGE_TAG=${GITHUB_REF/refs\/tags\//} fi # Image Names - # Note: the images produced by the build are acutally manifest lists, so in order to - # combine them into a single multi-platform manifest we need to reference the - # individual components by digest. - AMD64_IMAGE_NAME="$IMAGE_REPO:amd64-$IMAGE_TAG" - ARM64_IMAGE_NAME="$IMAGE_REPO:arm64-$IMAGE_TAG" - echo "amd64_image_name=${IMAGE_REPO}@$(docker buildx imagetools inspect $AMD64_IMAGE_NAME --format '{{json .Manifest}}' | jq -r '.manifests[0].digest')" >> $GITHUB_OUTPUT - echo "arm64_image_name=${IMAGE_REPO}@$(docker buildx imagetools inspect $ARM64_IMAGE_NAME --format '{{json .Manifest}}' | jq -r '.manifests[0].digest')" >> $GITHUB_OUTPUT + echo "amd64_image_name=$IMAGE_REPO:amd64-$IMAGE_TAG" >> $GITHUB_OUTPUT + echo "arm64_image_name=$IMAGE_REPO:arm64-$IMAGE_TAG" >> $GITHUB_OUTPUT echo "image_name=$IMAGE_REPO:$IMAGE_TAG" >> $GITHUB_OUTPUT - PODMAN_AMD64_IMAGE_NAME="$IMAGE_REPO:podman-amd64-$IMAGE_TAG" - PODMAN_ARM64_IMAGE_NAME="$IMAGE_REPO:podman-arm64-$IMAGE_TAG" - echo "podman_amd64_image_name=${IMAGE_REPO}@$(docker buildx imagetools inspect $PODMAN_AMD64_IMAGE_NAME --format '{{json .Manifest}}' | jq -r '.manifests[0].digest')" >> $GITHUB_OUTPUT - echo "podman_arm64_image_name=${IMAGE_REPO}@$(docker buildx imagetools inspect $PODMAN_ARM64_IMAGE_NAME --format '{{json .Manifest}}' | jq -r '.manifests[0].digest')" >> $GITHUB_OUTPUT + echo "podman_amd64_image_name=$IMAGE_REPO:podman-amd64-$IMAGE_TAG" >> $GITHUB_OUTPUT + echo "podman_arm64_image_name=$IMAGE_REPO:podman-arm64-$IMAGE_TAG" >> $GITHUB_OUTPUT echo "podman_image_name=$IMAGE_REPO:podman-$IMAGE_TAG" >> $GITHUB_OUTPUT - name: Create and push manifest diff --git a/.portage.yml b/.portage.yml index 9fa5fc5..6f28eca 100644 --- a/.portage.yml +++ b/.portage.yml @@ -9,18 +9,12 @@ imageBuild: enabled: true # Enable/Disable the image build pipeline (true/false) buildDir: "." # Build directory for image (e.g. ./cmd/portage) dockerfile: "Dockerfile" # Dockerfile to use (e.g. ./cmd/portage/Dockerfile) - platform: "" # Target platform (e.g. linux/amd64, linux/arm64) - target: "" # Target stage for multi-stage builds (e.g. build, test, publish) - cacheTo: "" # Cache export location (e.g. type=local,dest=path) - cacheFrom: "" # Cache import location (e.g. type=local,src=path) squashLayers: false # Whether to squash layers (true/false) - args: {} # Build arguments (e.g. BUILD_ARGS=--build-arg=key=value) # Image Scan Configuration imageScan: enabled: true # Enable/Disable the image scan pipeline (true/false) syftFilename: "syft-sbom-report.json" # Filename for the syft sbom report (e.g. syft-sbom-report.json) - grypeConfigFilename: "" # Filename for the grype config (e.g. grype-config.json) grypeFilename: "grype-vulnerability-report-full.json" # Filename for the grype vulnerability report (e.g. grype-vulnerability-report-full.json) clamavFilename: "clamav-virus-report.txt" # Filename for the clamav virus report (e.g. clamav-virus-report.txt) @@ -34,7 +28,6 @@ codeScan: # This is overridden in the portage Dockerfile, but is set to false here for runs on local systems # where the standard Python semgrep is installed semgrepExperimental: false # Whether to use the experimental semgrep CLI (true/false) - coverageFile: "" # Externally generated code coverage file semgrepSrcDir: "." # Target directory for semgrep scan (e.g. ./cmd/portage) # Image Publish Configuration @@ -45,7 +38,3 @@ imagePublish: # Deploy Configuration deploy: enabled: false # Enable/Disable the deploy pipeline (true/false). When true, the .gatecheck.yml file is used, otherwise the default gatecheck config is used. - gatecheckConfigFilename: ".custom-gatecheck.yml" # Filename for gatecheck config which specifies the validation rules and limits applied during the deployment process - successWebhooks: - - url: "https://belay-api.dev.holomuatech.online/Build/SubmitArtifacts" # Using the same endpoint from .custom-gatecheck.yml for consistency - authorizationVar: "DEPLOY_WEBHOOK_AUTH_HEADER" # Environment variable containing the auth header value