Skip to content

Commit da2184f

Browse files
denismakogondenismakogon
authored
Adding Anchore CI check (#77)
* Adding Snyk CI check * Install NodeJS with sudo * Fix nodejs install script * Fix CI build script * Enable 3.7.1 snyk check * Make 3.7.1 dev and runtime images safe * Make 3.6 dev and runtime images safe * some fixes - moving CI config file into .circleci - adding image release script - fixing 3.7.1 snyk checks * add missing fi * add dev images to release script * Fix after rebase * Simplify dockerfiles - almost all CWEs and CVEs going away with just "apt-get upgrade" * hide snyk token * get rid of snyk in favour of anchore * retrigger ci workflow * adding orb ref * adding policy bundle for anchore * attempting to fix anchore orb bug * Make config actually work * Adjust CI config * Split dev and runtime check jobs This change is related to recently discovered bug in ci-tools of Anchore. Therefore, had to define 1 job per image build + check * add missing bundle reference * add missing bundle reference * testing new Anchore CI orb 1.3.0 features * adding bash install * add remote docker job * make image checks scheduled * run scheduled job on master branch only * split fdk job in two: test and deploy
1 parent 7fd5fba commit da2184f

10 files changed

Lines changed: 177 additions & 38 deletions

File tree

‎.circleci/.anchore/policy_bundle.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"id": "default0",
3+
"version": "1_0",
4+
"name": "My Default bundle",
5+
"comment": "My system's default bundle",
6+
"whitelisted_images": [],
7+
"blacklisted_images": [],
8+
"mappings": [],
9+
"whitelists": [],
10+
"policies": [
11+
{
12+
"name": "IgnoreUnfixablePkgs",
13+
"version": "1_0",
14+
"comment": "Policy for basic checks",
15+
"id": "ba6daa06-da3b-46d3-9e22-f01f07b0489a",
16+
"rules": [
17+
{
18+
"action": "STOP",
19+
"gate": "vulnerabilities",
20+
"id": "80569900-d6b3-4391-b2a0-bf34cf6d813d",
21+
"params": [
22+
{ "name": "package_type", "value": "all" },
23+
{ "name": "severity_comparison", "value": ">=" },
24+
{ "name": "severity", "value": "medium" },
25+
{ "name": "fix_available", "value": "true"}
26+
],
27+
"trigger": "package"
28+
}
29+
]
30+
}
31+
32+
]
33+
}

‎.circleci/config.yml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
version: 2.1
2+
orbs:
3+
anchore: anchore/anchore-engine@1.3.0
4+
jobs:
5+
"test":
6+
docker:
7+
- image: circleci/python:3.7.0
8+
working_directory: ~/fdk-python
9+
steps:
10+
- checkout
11+
- restore_cache:
12+
key: deps1-{{ .Branch }}-{{ checksum "requirements.txt" }}
13+
- setup_remote_docker:
14+
docker_layer_caching: true
15+
- run:
16+
command: |
17+
python3 -m venv venv
18+
. venv/bin/activate
19+
pip install tox
20+
pip install -r requirements.txt
21+
- run: docker version
22+
- run: docker pull fnproject/fnserver
23+
- save_cache:
24+
key: deps1-{{ .Branch }}-{{ checksum "requirements.txt" }}
25+
paths:
26+
- "venv"
27+
- run:
28+
command: |
29+
. venv/bin/activate
30+
tox -epep8
31+
- run:
32+
command: |
33+
. venv/bin/activate
34+
tox -epy3.7
35+
"deploy":
36+
docker:
37+
- image: circleci/python:3.7.0
38+
working_directory: ~/fdk-python
39+
steps:
40+
- checkout
41+
- restore_cache:
42+
key: deps1-{{ .Branch }}-{{ checksum "requirements.txt" }}
43+
- setup_remote_docker:
44+
docker_layer_caching: true
45+
- deploy:
46+
# TODO(denismakogon): add pypi release here as well
47+
command: |
48+
if [[ "${CIRCLE_BRANCH}" == "master" && -z "${CIRCLE_PR_REPONAME}" ]]; then
49+
printenv DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin
50+
./build-images.sh 3.6
51+
./build-images.sh 3.7.1
52+
./release_images.sh
53+
fi
54+
55+
"python36_security_check":
56+
executor: anchore/anchore_engine
57+
working_directory: ~/fdk-python
58+
steps:
59+
- setup_remote_docker:
60+
docker_layer_caching: true
61+
- checkout
62+
- run:
63+
name: Python 3.6 build
64+
command: |
65+
apk add bash
66+
./build-images.sh 3.6
67+
- anchore/analyze_local_image:
68+
image_name: "fnproject/python:3.6-dev fnproject/python:3.6"
69+
timeout: '500'
70+
policy_failure: true
71+
policy_bundle_file_path: .circleci/.anchore/policy_bundle.json
72+
- anchore/parse_reports
73+
74+
"python371_security_check":
75+
executor: anchore/anchore_engine
76+
working_directory: ~/fdk-python
77+
steps:
78+
- setup_remote_docker:
79+
docker_layer_caching: true
80+
- checkout
81+
- run:
82+
name: Python 3.7.1 build
83+
command: |
84+
apk add bash
85+
./build-images.sh 3.7.1
86+
- anchore/analyze_local_image:
87+
image_name: "fnproject/python:3.7.1-dev fnproject/python:3.7.1"
88+
timeout: '500'
89+
policy_failure: true
90+
policy_bundle_file_path: .circleci/.anchore/policy_bundle.json
91+
- anchore/parse_reports
92+
93+
workflows:
94+
version: 2
95+
build:
96+
jobs:
97+
- "test"
98+
commit:
99+
jobs:
100+
- "test"
101+
- "deploy"
102+
nightly:
103+
triggers:
104+
- schedule:
105+
cron: "0 0 * * *"
106+
filters:
107+
branches:
108+
only:
109+
- master
110+
jobs:
111+
- "python36_security_check"
112+
- "python371_security_check"

‎.gitignore‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,6 @@ python-troveclient.iml
114114
# Files created by releasenotes build
115115
releasenotes/build
116116
.coverage.*
117-
*.json
118117
.cache
119118
*.log*
120119
*.csv
@@ -127,4 +126,4 @@ data/
127126

128127
func.yaml
129128
func.yml
130-
test_function/
129+
test_function/

‎build-images.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env bash
2+
3+
set -xe
4+
5+
pyversion=${1:-"3.7.1"}
6+
7+
pushd images/build-stage/${pyversion} && docker build -t fnproject/python:${pyversion}-dev . && popd
8+
pushd images/runtime/${pyversion} && docker build -t fnproject/python:${pyversion} . && popd

‎circle.yml‎

Lines changed: 0 additions & 32 deletions
This file was deleted.

‎images/build-stage/3.6/Dockerfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
FROM python:3.6-slim-stretch
22

3-
RUN apt-get update && apt-get install --no-install-recommends -qy build-essential gcc && apt-get clean
3+
RUN apt-get update && apt-get upgrade -qy && \
4+
apt-get install --no-install-recommends -qy build-essential gcc && \
5+
apt-get clean

‎images/build-stage/3.7.1/Dockerfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
FROM python:3.7.1-slim-stretch
22

3-
RUN apt-get update && apt-get install --no-install-recommends -qy build-essential gcc && apt-get clean
3+
RUN apt-get update && apt-get upgrade -qy && \
4+
apt-get install --no-install-recommends -qy build-essential gcc && \
5+
apt-get clean

‎images/runtime/3.6/Dockerfile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
FROM python:3.6-slim-stretch
22

3-
RUN addgroup --gid 1000 --system fn && adduser --system --uid 1000 --ingroup fn fn
3+
RUN apt-get update && apt-get upgrade -qy && apt-get clean
4+
RUN addgroup --system --gid 1000 --system fn && adduser --system --uid 1000 --ingroup fn fn

‎images/runtime/3.7.1/Dockerfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
FROM python:3.7.1-slim-stretch
22

3-
RUN addgroup --gid 1000 --system fn && adduser --system --uid 1000 --ingroup fn fn
3+
4+
RUN apt-get update && apt-get upgrade -qy && apt-get clean
5+
RUN addgroup --system --gid 1000 --system fn && adduser --system --uid 1000 --ingroup fn fn

‎release_images.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env bash
2+
3+
user="fnproject"
4+
image="python"
5+
runtime36="3.6"
6+
runtime371="3.7.1"
7+
8+
docker push ${user}/${image}:${runtime36}
9+
docker push ${user}/${image}:${runtime36}-dev
10+
11+
docker push ${user}/${image}:${runtime371}
12+
docker push ${user}/${image}:${runtime371}-dev

0 commit comments

Comments
 (0)