From 1fd70923c6a32366e21c3c101d7337536a2d3cad Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Wed, 8 Apr 2026 13:03:52 +0200 Subject: [PATCH 01/27] Symfony docker github url added in README --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e400081..8c78c32 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ [![CI](https://github.com/llegaz/frankenphp-slim/actions/workflows/ci.yaml/badge.svg)](https://github.com/llegaz/frankenphp-slim/actions/workflows/ci.yaml) -This project is largely inspired from [Kévin Dunglas](https://dunglas.dev)'s project Symfony Docker. it aims to provide a ready to use install for a slim project using frankenPHP server and vulcain / mercure technologies for SSE as well. +This project is largely inspired from [Kévin Dunglas](https://dunglas.dev)'s project [Symfony Docker](https://github.com/dunglas/symfony-docker), it aims to provide a ready to use install for a slim project using frankenPHP server and vulcain / mercure technologies for SSE and hot reloading. ## Getting Started @@ -60,5 +60,5 @@ frankenphp-slim is available under the MIT License. ## Credits -By [Laurent Legaz](http://laurent.legaz.eu), largely inspired from [Kévin Dunglas](https://dunglas.dev)'s project Symfony Docker. +By [Laurent Legaz](http://laurent.legaz.eu), largely inspired from [Kévin Dunglas](https://dunglas.dev)'s project [Symfony Docker](https://github.com/dunglas/symfony-docker). From 687652d2eee1d9ee9a69ad43cebd0a7a89a8972b Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Wed, 8 Apr 2026 13:19:39 +0200 Subject: [PATCH 02/27] add some deploying section in README.md --- README.md | 76 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) diff --git a/README.md b/README.md index 8c78c32..e8abedb 100644 --- a/README.md +++ b/README.md @@ -54,6 +54,82 @@ sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keyc **Enjoy!** +## Deploying + +Copy your project on the server using `git clone`, `scp`, or any other tool +that may fit your need. +If you use GitHub, you may want to use [a deploy key](https://docs.github.com/en/free-pro-team@latest/developers/overview/managing-deploy-keys#deploy-keys). +Deploy keys are also [supported by GitLab](https://docs.gitlab.com/user/project/deploy_keys/). + +Example with Git: + +```console +git clone git@github.com:/.git +``` + +Go into the directory containing your project (``), +and start the app in production mode: + +```console +# Build fresh production image +docker compose -f compose.yaml -f compose.prod.yaml build --pull --no-cache + +# Start container +SERVER_NAME=your-domain-name.example.com \ +APP_SECRET=ChangeMe \ +CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey \ +docker compose -f compose.yaml -f compose.prod.yaml up --wait +``` + +Be sure to replace `your-domain-name.example.com` with your actual domain name +and to set the values of `APP_SECRET`, `CADDY_MERCURE_JWT_SECRET` +to cryptographically secure random values. + +Your server is up and running, and a HTTPS certificate has been automatically +generated for you. +Go to `https://your-domain-name.example.com` and **enjoy!** + +> [!CAUTION] +> +> Docker can have a cache layer, make sure you have the right build +> for each deployment or rebuild your project with `--no-cache` option +> to avoid cache issues. + +## Disabling HTTPS + +Alternatively, if you don't want to expose an HTTPS server but only an HTTP one, +run the following command: + +```console +SERVER_NAME=:80 \ +APP_SECRET=ChangeMe \ +CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey \ +docker compose -f compose.yaml -f compose.prod.yaml up --wait +``` + +## Deploying on Multiple Nodes + +If you want to deploy your app on a cluster of machines, you can use [Docker Swarm](https://docs.docker.com/engine/swarm/stack-deploy/), +which is compatible with the provided Compose files. +To deploy on Kubernetes, take a look +at [the Helm chart provided with API Platform](https://api-platform.com/docs/deployment/kubernetes/), +which can be easily adapted for use with Symfony Docker. + +## Passing local environment variables to containers + +By default, `.env.local` and `.env.*.local` files are excluded from production images. +If you want to pass them to your containers, you can use the [`env_file` attribute](https://docs.docker.com/compose/how-tos/environment-variables/set-environment-variables/#use-the-env_file-attribute): + +```yaml +# compose.prod.yaml + +services: + php: + env_file: + - .env.prod.local + # ... +``` + ## License frankenphp-slim is available under the MIT License. From de53fdac2056089a67ff30feb9949b94efd9c127 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Wed, 8 Apr 2026 13:26:43 +0200 Subject: [PATCH 03/27] clearer explanation on README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index e8abedb..16a5d78 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ This project is largely inspired from [Kévin Dunglas](https://dunglas.dev)'s pr 4. Open `https://localhost` in your favorite web browser 5. Run `docker compose down --remove-orphans` to stop the Docker containers. -## Set the freshly generated Caddy certificate into your local browser +## Add the authority to the trust store of the host ```bash docker cp :/data/caddy/pki/authorities/local/root.crt ./caddy-root.crt ``` From e7719c8ad23f424f3f9ee48d69de77012ab8d174 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Wed, 8 Apr 2026 14:15:55 +0200 Subject: [PATCH 04/27] Dockerfile prod stage fix --- Dockerfile | 31 ++++++++++++++++++++----------- README.md | 8 +++++--- 2 files changed, 25 insertions(+), 14 deletions(-) diff --git a/Dockerfile b/Dockerfile index 046b866..25881f8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -70,6 +70,9 @@ RUN <<-EOF iptables \ jq \ sudo +# pstree +# procps +# net-tools install-php-extensions xdebug rm -rf /var/lib/apt/lists/* useradd -m -s /bin/bash nonroot @@ -91,22 +94,28 @@ RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" COPY --link frankenphp/conf.d/20-app.prod.ini $PHP_INI_DIR/app.conf.d/ # prevent the reinstallation of vendors at every changes in the source code -COPY --link composer.* symfony.* ./ -RUN composer install --no-cache --prefer-dist --no-dev --no-autoloader --no-scripts --no-progress - -# copy sources -COPY --link --exclude=frankenphp/ . ./ - -RUN <<-EOF - mkdir -p var/cache var/log var/share - composer dump-autoload --classmap-authoritative --no-dev -EOF +COPY --link src/composer.* /app/src/ +RUN composer install \ + --working-dir=/app/src \ + --no-cache \ + --prefer-dist \ + --no-dev \ + --no-autoloader \ + --no-scripts \ + --no-progress + +COPY --link src/ /app/src/ + +RUN composer dump-autoload \ + --working-dir=/app/src \ + --classmap-authoritative \ + --no-dev # Collect shared libraries needed by FrankenPHP and PHP extensions # hadolint ignore=DL3008,SC3054,DL4006 RUN <<-'EOF' apt-get update - apt-get install -y --no-install-recommends libtree pstree procps net- + apt-get install -y --no-install-recommends libtree mkdir -p /tmp/libs BINARIES=(frankenphp php file) touch my_log.txt diff --git a/README.md b/README.md index 16a5d78..5e4f8d1 100644 --- a/README.md +++ b/README.md @@ -71,13 +71,15 @@ Go into the directory containing your project (``), and start the app in production mode: ```console +# set needed ENV variables +export SERVER_NAME=your-domain-name.example.com \ +export APP_SECRET=ChangeMe \ +export CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey + # Build fresh production image docker compose -f compose.yaml -f compose.prod.yaml build --pull --no-cache # Start container -SERVER_NAME=your-domain-name.example.com \ -APP_SECRET=ChangeMe \ -CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey \ docker compose -f compose.yaml -f compose.prod.yaml up --wait ``` From b8abbd460849088116abc665ffb4456a02f5df8f Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Wed, 8 Apr 2026 15:15:13 +0200 Subject: [PATCH 05/27] almost done --- Dockerfile | 6 +----- LICENSE | 2 +- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index 25881f8..b0aeefe 100644 --- a/Dockerfile +++ b/Dockerfile @@ -150,11 +150,7 @@ COPY --from=frankenphp_prod_builder /usr/local/etc/php/php.ini /usr/local/etc/ph COPY --from=frankenphp_prod_builder /usr/local/etc/php/app.conf.d /usr/local/etc/php/app.conf.d COPY --from=frankenphp_prod_builder /etc/frankenphp/Caddyfile /etc/frankenphp/Caddyfile - -# CA certificates for TLS, file/libmagic for Symfony MIME type detection COPY --from=frankenphp_prod_builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt -COPY --from=frankenphp_prod_builder /usr/bin/file /usr/bin/file -COPY --from=frankenphp_prod_builder /usr/lib/file/magic.mgc /usr/lib/file/magic.mgc ENV XDG_CONFIG_HOME=/config XDG_DATA_HOME=/data @@ -165,7 +161,7 @@ RUN <<-EOF find / -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null || true EOF -COPY --link --exclude=var --from=frankenphp_prod_builder /app /app +COPY --link --from=frankenphp_prod_builder /app /app COPY --chown=www-data:www-data --from=frankenphp_prod_builder /app/src/logs /app/src/logs COPY --link --chmod=755 frankenphp/docker-entrypoint.sh /usr/local/bin/docker-entrypoint diff --git a/LICENSE b/LICENSE index 38a3b3c..20e2ae1 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2017-2025 Laurent LEGAZ +Copyright (c) 2026 Laurent LEGAZ Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal From 7b475a9c5fc4db510bf91cc8c9a1db25d5e04d78 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Thu, 9 Apr 2026 08:09:48 +0200 Subject: [PATCH 06/27] README.md last updates --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 5e4f8d1..42be704 100644 --- a/README.md +++ b/README.md @@ -50,7 +50,7 @@ sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keyc - [Vulcain](https://vulcain.rocks) support - [Hot Reloading](https://frankenphp.dev/docs/hot-reload/) - Rootless, slim production image -- This project should have a native [XDebug](docs/xdebug.md) integration (but I did not test it yet) +- This project should have a native [XDebug](docs/xdebug.md) integration (sole point that I did not test here yet) **Enjoy!** @@ -103,9 +103,9 @@ Alternatively, if you don't want to expose an HTTPS server but only an HTTP one, run the following command: ```console -SERVER_NAME=:80 \ -APP_SECRET=ChangeMe \ -CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey \ +export SERVER_NAME=:80\ +export APP_SECRET=ChangeMe\ +export CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey\ docker compose -f compose.yaml -f compose.prod.yaml up --wait ``` From 16c021384a456600a295536228a9a8363952d62f Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 13:22:49 +0200 Subject: [PATCH 07/27] back and forth now Ineed to fix CI again --- README.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 42be704..add0e28 100644 --- a/README.md +++ b/README.md @@ -71,15 +71,13 @@ Go into the directory containing your project (``), and start the app in production mode: ```console -# set needed ENV variables -export SERVER_NAME=your-domain-name.example.com \ -export APP_SECRET=ChangeMe \ -export CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey - # Build fresh production image docker compose -f compose.yaml -f compose.prod.yaml build --pull --no-cache # Start container +SERVER_NAME=your-domain-name.example.com \ +APP_SECRET=ChangeMe \ +CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey \ docker compose -f compose.yaml -f compose.prod.yaml up --wait ``` @@ -103,9 +101,9 @@ Alternatively, if you don't want to expose an HTTPS server but only an HTTP one, run the following command: ```console -export SERVER_NAME=:80\ -export APP_SECRET=ChangeMe\ -export CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey\ +SERVER_NAME=:80 \ +APP_SECRET=ChangeMe \ +CADDY_MERCURE_JWT_SECRET=Key \ docker compose -f compose.yaml -f compose.prod.yaml up --wait ``` From d7ea496746277a69d40b47cd5ac9493126d2f10b Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 13:38:58 +0200 Subject: [PATCH 08/27] GITHUB_TOKEN tweak test --- .github/workflows/ci.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 1f4a539..da12f13 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -5,8 +5,10 @@ on: push: branches: - main - pull_request: ~ - workflow_dispatch: ~ +# pull_request: ~ +# workflow_dispatch: ~ + pull_request_target: + types: [assigned, opened, synchronize, reopened] permissions: contents: read From bc16ac4f452b7cb6158fd689a7d3f6c1cab90918 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 13:45:58 +0200 Subject: [PATCH 09/27] ci test --- .github/workflows/ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index da12f13..d1f92b0 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -5,8 +5,8 @@ on: push: branches: - main -# pull_request: ~ -# workflow_dispatch: ~ + pull_request: ~ + workflow_dispatch: ~ pull_request_target: types: [assigned, opened, synchronize, reopened] From a1df05b571a2fff04857af8f9062d6c8574f3922 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 14:19:18 +0200 Subject: [PATCH 10/27] back and forth, zizmor does not like pull_request_target directive --- .github/workflows/ci.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d1f92b0..1f4a539 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -7,8 +7,6 @@ on: - main pull_request: ~ workflow_dispatch: ~ - pull_request_target: - types: [assigned, opened, synchronize, reopened] permissions: contents: read From 65612765afa5f607830e906695e74271b54d07c3 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 14:32:17 +0200 Subject: [PATCH 11/27] typo --- Dockerfile | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index b0aeefe..cb4cff6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -69,10 +69,11 @@ RUN <<-EOF ipset \ iptables \ jq \ +# pstree \ +# procps \ +# net-tools \ sudo -# pstree -# procps -# net-tools + install-php-extensions xdebug rm -rf /var/lib/apt/lists/* useradd -m -s /bin/bash nonroot From 917bfa9e418fe1f74f948da48bcf62a83fdf7928 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 14:44:50 +0200 Subject: [PATCH 12/27] remove debug superfluous utilitaries for good --- Dockerfile | 3 --- 1 file changed, 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index cb4cff6..2f456a3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -69,9 +69,6 @@ RUN <<-EOF ipset \ iptables \ jq \ -# pstree \ -# procps \ -# net-tools \ sudo install-php-extensions xdebug From c26b45614636d680fc94f7df87ec921795ab98fa Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Wed, 8 Apr 2026 15:28:42 +0200 Subject: [PATCH 13/27] added new security ci workflow based on docker scout --- .github/workflows/security.yml | 39 ++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..01b91f4 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,39 @@ +--- +name: Security Scan + +on: + push: + branches: [main, dev] + pull_request: + +jobs: + scan: + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Login to Docker Hub + uses: docker/login-action@v4 + with: + username: ${{ secrets.DOCKER_USER }} + password: ${{ secrets.DOCKER_PAT }} + + - name: Build prod image + run: | + docker build \ + --target frankenphp_prod \ + -t app-php-prod:${{ github.sha }} . + + - name: Docker Scout CVEs + uses: docker/scout-action@v1 + with: + command: cves + image: app-php-prod:${{ github.sha }} + only-severities: critical,high + exit-code: true + github-token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file From 2b213b7ba41aad7a6d44f2ae7b0a58f5e729af31 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Wed, 8 Apr 2026 16:05:41 +0200 Subject: [PATCH 14/27] security CI workflow fix --- .github/workflows/security.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 01b91f4..99a81e6 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -23,17 +23,20 @@ jobs: username: ${{ secrets.DOCKER_USER }} password: ${{ secrets.DOCKER_PAT }} - - name: Build prod image - run: | - docker build \ - --target frankenphp_prod \ - -t app-php-prod:${{ github.sha }} . + - name: Scan FrankenPHP Upstream + uses: docker/scout-action@v1 + with: + command: cves + image: dunglas/frankenphp:1-php8.5 + only-severities: critical,high + exit-code: false + github-token: ${{ secrets.GITHUB_TOKEN }} - - name: Docker Scout CVEs + - name: Scan Debian Prod Base uses: docker/scout-action@v1 with: command: cves - image: app-php-prod:${{ github.sha }} + image: debian:13-slim only-severities: critical,high exit-code: true github-token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file From 70cc32fe79aaf369216feb76f3f388672b86f79e Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Wed, 8 Apr 2026 16:34:49 +0200 Subject: [PATCH 15/27] report only no build fail --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 99a81e6..90c973e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -38,5 +38,5 @@ jobs: command: cves image: debian:13-slim only-severities: critical,high - exit-code: true + exit-code: false github-token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file From 62521b6bb4daae63690c7bf646f43b941e6a1a94 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Thu, 9 Apr 2026 08:06:36 +0200 Subject: [PATCH 16/27] comment non needed secrets --- .github/workflows/security.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 90c973e..78bb236 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -17,11 +17,12 @@ jobs: - name: Checkout uses: actions/checkout@v4 - - name: Login to Docker Hub - uses: docker/login-action@v4 - with: - username: ${{ secrets.DOCKER_USER }} - password: ${{ secrets.DOCKER_PAT }} +# does not please zizmor comment for now + # - name: Login to Docker Hub + # uses: docker/login-action@v4 + # with: + # username: ${{ secrets.DOCKER_USER }} + # password: ${{ secrets.DOCKER_PAT }} - name: Scan FrankenPHP Upstream uses: docker/scout-action@v1 From 93f384e2991cdf15cd53cfd5664755a4a6e81925 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 14:29:35 +0200 Subject: [PATCH 17/27] security: inject secrets via env instead of direct inputs --- .github/workflows/security.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 78bb236..9ded086 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -9,6 +9,9 @@ on: jobs: scan: runs-on: ubuntu-latest + env: + DOCKER_USER: ${{ secrets.DOCKER_USER }} + DOCKER_PAT: ${{ secrets.DOCKER_PAT }} permissions: contents: read pull-requests: write @@ -18,11 +21,11 @@ jobs: uses: actions/checkout@v4 # does not please zizmor comment for now - # - name: Login to Docker Hub - # uses: docker/login-action@v4 - # with: - # username: ${{ secrets.DOCKER_USER }} - # password: ${{ secrets.DOCKER_PAT }} + - name: Login to Docker Hub + uses: docker/login-action@v4 + with: + username: ${{ env.DOCKER_USER }} + password: ${{ env.DOCKER_PAT }} - name: Scan FrankenPHP Upstream uses: docker/scout-action@v1 From 58aba6bf750d674955a08062aaddd1aebb75ae57 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 16:09:25 +0200 Subject: [PATCH 18/27] do not persist credentials --- .github/workflows/security.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 9ded086..701e1d8 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -18,9 +18,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 + with: + persist-credentials: false -# does not please zizmor comment for now - name: Login to Docker Hub uses: docker/login-action@v4 with: From ac5ddcd56b790057f31f5b488d6a2b57bf21d84f Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 16:27:50 +0200 Subject: [PATCH 19/27] new environment added for security measure --- .github/workflows/security.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 701e1d8..d613b42 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -9,6 +9,8 @@ on: jobs: scan: runs-on: ubuntu-latest + environment: "open source" + env: DOCKER_USER: ${{ secrets.DOCKER_USER }} DOCKER_PAT: ${{ secrets.DOCKER_PAT }} From b8a31385de912574f3da6d986598d204dbe0e112 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 16:42:03 +0200 Subject: [PATCH 20/27] force PR comment for CVEs report --- .github/workflows/security.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d613b42..554880b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -37,6 +37,7 @@ jobs: image: dunglas/frankenphp:1-php8.5 only-severities: critical,high exit-code: false + write-comment: true github-token: ${{ secrets.GITHUB_TOKEN }} - name: Scan Debian Prod Base @@ -46,4 +47,5 @@ jobs: image: debian:13-slim only-severities: critical,high exit-code: false + write-comment: true github-token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file From 7131cf9b6d77dcc6f0c72629e9742ae15d881f97 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 16:46:45 +0200 Subject: [PATCH 21/27] add CVEs reports to actions summary --- .github/workflows/security.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 554880b..6759c0c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -39,6 +39,10 @@ jobs: exit-code: false write-comment: true github-token: ${{ secrets.GITHUB_TOKEN }} + output: frankenphp-report.md + + - name: Add CVEs frankenphp report to Actions Summary + run: cat frankenphp-report.md >> $GITHUB_STEP_SUMMARY - name: Scan Debian Prod Base uses: docker/scout-action@v1 @@ -48,4 +52,8 @@ jobs: only-severities: critical,high exit-code: false write-comment: true - github-token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file + github-token: ${{ secrets.GITHUB_TOKEN }} + output: debian-report.md + + - name: Add CVEs debien report to Actions Summary + run: cat debian-report.md >> $GITHUB_STEP_SUMMARY \ No newline at end of file From 5052e01e7de8663a7f7ae65e93998b7209512389 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 16:54:48 +0200 Subject: [PATCH 22/27] fix send report to summary cmd --- .github/workflows/security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 6759c0c..d78f26e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -42,7 +42,7 @@ jobs: output: frankenphp-report.md - name: Add CVEs frankenphp report to Actions Summary - run: cat frankenphp-report.md >> $GITHUB_STEP_SUMMARY + run: cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" - name: Scan Debian Prod Base uses: docker/scout-action@v1 @@ -56,4 +56,4 @@ jobs: output: debian-report.md - name: Add CVEs debien report to Actions Summary - run: cat debian-report.md >> $GITHUB_STEP_SUMMARY \ No newline at end of file + run: cat debian-report.md >> "$GITHUB_STEP_SUMMARY" \ No newline at end of file From 7f06f9d8792a775d84556be993252fb3dd8c085d Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 17:15:36 +0200 Subject: [PATCH 23/27] final version --- .github/workflows/security.yml | 42 +++++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 13 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d78f26e..63ef4b9 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -1,31 +1,35 @@ --- -name: Security Scan +name: CVE Analysis on: push: branches: [main, dev] pull_request: + branches: [main, dev] + workflow_dispatch: jobs: - scan: + analyze: + name: Upstream Images Scan runs-on: ubuntu-latest environment: "open source" - env: - DOCKER_USER: ${{ secrets.DOCKER_USER }} - DOCKER_PAT: ${{ secrets.DOCKER_PAT }} permissions: contents: read pull-requests: write + env: + DOCKER_USER: ${{ secrets.DOCKER_USER }} + DOCKER_PAT: ${{ secrets.DOCKER_PAT }} + steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v4 with: persist-credentials: false - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@v3 with: username: ${{ env.DOCKER_USER }} password: ${{ env.DOCKER_PAT }} @@ -41,10 +45,7 @@ jobs: github-token: ${{ secrets.GITHUB_TOKEN }} output: frankenphp-report.md - - name: Add CVEs frankenphp report to Actions Summary - run: cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" - - - name: Scan Debian Prod Base + - name: Scan Debian Base uses: docker/scout-action@v1 with: command: cves @@ -55,5 +56,20 @@ jobs: github-token: ${{ secrets.GITHUB_TOKEN }} output: debian-report.md - - name: Add CVEs debien report to Actions Summary - run: cat debian-report.md >> "$GITHUB_STEP_SUMMARY" \ No newline at end of file + - name: Publish Results to Summary + if: always() + run: | + echo "# 🛡️ CVE Analysis Report" >> "$GITHUB_STEP_SUMMARY" + echo "## 🐘 FrankenPHP Upstream" >> "$GITHUB_STEP_SUMMARY" + if [ -f frankenphp-report.md ]; then + cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" + else + echo "⚠️ No FrankenPHP report generated." >> "$GITHUB_STEP_SUMMARY" + fi + echo "---" >> "$GITHUB_STEP_SUMMARY" + echo "## 🐧 Debian Base" >> "$GITHUB_STEP_SUMMARY" + if [ -f debian-report.md ]; then + cat debian-report.md >> "$GITHUB_STEP_SUMMARY" + else + echo "⚠️ No Debian report generated." >> "$GITHUB_STEP_SUMMARY" + fi \ No newline at end of file From c9586f3c231ca4a6bba661f0df5d88e6254d5892 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 17:48:08 +0200 Subject: [PATCH 24/27] gemini frustration --- .github/workflows/security.yml | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 63ef4b9..8777e26 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -3,10 +3,9 @@ name: CVE Analysis on: push: - branches: [main, dev] + branches: ["**"] pull_request: - branches: [main, dev] - workflow_dispatch: + workflow_dispatch: {} jobs: analyze: @@ -61,15 +60,7 @@ jobs: run: | echo "# 🛡️ CVE Analysis Report" >> "$GITHUB_STEP_SUMMARY" echo "## 🐘 FrankenPHP Upstream" >> "$GITHUB_STEP_SUMMARY" - if [ -f frankenphp-report.md ]; then - cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" - else - echo "⚠️ No FrankenPHP report generated." >> "$GITHUB_STEP_SUMMARY" - fi + cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || echo "⚠️ No FrankenPHP report generated." >> "$GITHUB_STEP_SUMMARY" echo "---" >> "$GITHUB_STEP_SUMMARY" echo "## 🐧 Debian Base" >> "$GITHUB_STEP_SUMMARY" - if [ -f debian-report.md ]; then - cat debian-report.md >> "$GITHUB_STEP_SUMMARY" - else - echo "⚠️ No Debian report generated." >> "$GITHUB_STEP_SUMMARY" - fi \ No newline at end of file + cat debian-report.md >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || echo "⚠️ No Debian report generated." >> "$GITHUB_STEP_SUMMARY" \ No newline at end of file From f3077406ad583fc5c3756018fdf2e887eb839163 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 18:00:11 +0200 Subject: [PATCH 25/27] OK done, launch scan on slected branchs only --- .github/workflows/security.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 8777e26..9b5f8f8 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -3,8 +3,9 @@ name: CVE Analysis on: push: - branches: ["**"] + branches: [main, dev] pull_request: + branches: [main, dev] workflow_dispatch: {} jobs: @@ -59,8 +60,8 @@ jobs: if: always() run: | echo "# 🛡️ CVE Analysis Report" >> "$GITHUB_STEP_SUMMARY" - echo "## 🐘 FrankenPHP Upstream" >> "$GITHUB_STEP_SUMMARY" + echo "## 🐘 FrankenPHP Upstream " >> "$GITHUB_STEP_SUMMARY" cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || echo "⚠️ No FrankenPHP report generated." >> "$GITHUB_STEP_SUMMARY" echo "---" >> "$GITHUB_STEP_SUMMARY" - echo "## 🐧 Debian Base" >> "$GITHUB_STEP_SUMMARY" + echo "## 🐧 Debian Base " >> "$GITHUB_STEP_SUMMARY" cat debian-report.md >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || echo "⚠️ No Debian report generated." >> "$GITHUB_STEP_SUMMARY" \ No newline at end of file From 136f5e359e3e7c9c43f644825d810a54951efa95 Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 18:28:29 +0200 Subject: [PATCH 26/27] finalize summary report for the CVEs analysis --- .github/workflows/security.yml | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 9b5f8f8..eccea1c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -59,9 +59,21 @@ jobs: - name: Publish Results to Summary if: always() run: | - echo "# 🛡️ CVE Analysis Report" >> "$GITHUB_STEP_SUMMARY" - echo "## 🐘 FrankenPHP Upstream " >> "$GITHUB_STEP_SUMMARY" - cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || echo "⚠️ No FrankenPHP report generated." >> "$GITHUB_STEP_SUMMARY" - echo "---" >> "$GITHUB_STEP_SUMMARY" - echo "## 🐧 Debian Base " >> "$GITHUB_STEP_SUMMARY" - cat debian-report.md >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || echo "⚠️ No Debian report generated." >> "$GITHUB_STEP_SUMMARY" \ No newline at end of file + echo "# 🛡️ CVE Analysis Summary" >> "$GITHUB_STEP_SUMMARY" + echo "Scan performed on $(date +'%Y-%m-%d %H:%M')" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + if [ -s frankenphp-report.md ]; then + echo "## 🐘 FrankenPHP Upstream" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + fi + if [ -s debian-report.md ]; then + echo "## 🐧 Debian Base" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + cat debian-report.md >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + fi + if [ ! -s frankenphp-report.md ] && [ ! -s debian-report.md ]; then + echo "> ✅ Reports were integrated directly by Docker Scout above." >> "$GITHUB_STEP_SUMMARY" + fi \ No newline at end of file From d3174e4fd4ab278fa4b4dfa056e4eb8af33a0bcb Mon Sep 17 00:00:00 2001 From: Laurent Legaz Date: Fri, 10 Apr 2026 18:37:14 +0200 Subject: [PATCH 27/27] add all commands in a single optimized block --- .github/workflows/security.yml | 38 ++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index eccea1c..cb3e39c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -59,21 +59,23 @@ jobs: - name: Publish Results to Summary if: always() run: | - echo "# 🛡️ CVE Analysis Summary" >> "$GITHUB_STEP_SUMMARY" - echo "Scan performed on $(date +'%Y-%m-%d %H:%M')" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - if [ -s frankenphp-report.md ]; then - echo "## 🐘 FrankenPHP Upstream" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - cat frankenphp-report.md >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - fi - if [ -s debian-report.md ]; then - echo "## 🐧 Debian Base" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - cat debian-report.md >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - fi - if [ ! -s frankenphp-report.md ] && [ ! -s debian-report.md ]; then - echo "> ✅ Reports were integrated directly by Docker Scout above." >> "$GITHUB_STEP_SUMMARY" - fi \ No newline at end of file + { + echo "# 🛡️ CVE Analysis Summary" + echo "Scan performed on $(date +'%Y-%m-%d %H:%M')" + echo "" + if [ -s frankenphp-report.md ]; then + echo "## 🐘 FrankenPHP Upstream" + echo "" + cat frankenphp-report.md + echo "" + fi + if [ -s debian-report.md ]; then + echo "## 🐧 Debian Base" + echo "" + cat debian-report.md + echo "" + fi + if [ ! -s frankenphp-report.md ] && [ ! -s debian-report.md ]; then + echo "> ✅ Reports were integrated directly by Docker Scout above." + fi + } >> "$GITHUB_STEP_SUMMARY" \ No newline at end of file