From 0b8cb1e46353c48f14fd7d664e3d039dfb1fe74b Mon Sep 17 00:00:00 2001 From: Jonathan Ho Date: Sat, 8 Apr 2023 07:30:42 -0700 Subject: [PATCH] ci(rest): proxy multi arch image (#2980) * ci(rest-proxy): multi arch image * ci(rest-proxy): fix doc * ci(rest-proxy): add test build multi arch image * ci(rest-proxy): update version * ci(rest-proxy): fix missing setup buildx * ci(rest-proxy): fix target * ci(rest-proxy): fix trivy * ci(rest-proxy): fix cache * ci(rest-proxy): load true * ci(rest-proxy): move image scan * ci(rest-proxy): fix name * ci(rest-proxy): fix cache * ci(rest-proxy): add name * ci(rest-proxy): add schedule scan * ci(rest-proxy): fix string * ci(rest-proxy): update cache version --- .github/workflows/rest-proxy.yml | 102 ++++++++++++++++++++++++++++--- proxies/rest/Dockerfile | 11 ++-- 2 files changed, 101 insertions(+), 12 deletions(-) diff --git a/.github/workflows/rest-proxy.yml b/.github/workflows/rest-proxy.yml index 8d72b9b9d..b7fdea47e 100644 --- a/.github/workflows/rest-proxy.yml +++ b/.github/workflows/rest-proxy.yml @@ -11,6 +11,8 @@ on: paths: - ".github/workflows/rest-proxy.yml" - "proxies/rest/**" + schedule: + - cron: "0 0 * * *" jobs: build: @@ -18,6 +20,13 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 + - name: Cache Docker layers + uses: actions/cache@v3 + with: + path: /tmp/.buildx-cache + key: ${{ runner.os }}-single-buildx-${{ github.sha }} + restore-keys: | + ${{ runner.os }}-single-buildx - name: Set up QEMU uses: docker/setup-qemu-action@v2 - name: Set up Docker Buildx @@ -30,30 +39,102 @@ jobs: context: proxies/rest target: runner outputs: type=docker,dest=/tmp/rest-proxy-image.tar + cache-from: type=local,src=/tmp/.buildx-cache + cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max + - # Temp fix + # https://github.com/docker/build-push-action/issues/252 + # https://github.com/moby/buildkit/issues/1896 + name: Move cache + run: | + rm -rf /tmp/.buildx-cache + mv /tmp/.buildx-cache-new /tmp/.buildx-cache - name: Upload artifact - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@v3 with: name: rest-proxy-image path: /tmp/rest-proxy-image.tar - use: + image-scan: + name: Image scan runs-on: ubuntu-latest needs: build steps: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 - name: Download artifact - uses: actions/download-artifact@v2 + uses: actions/download-artifact@v3 with: name: rest-proxy-image path: /tmp - name: Load Docker image run: docker load --input /tmp/rest-proxy-image.tar + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + with: + image-ref: "discordeno/rest-proxy:latest" + format: "table" + exit-code: "0" + ignore-unfixed: true + vuln-type: "os,library" + severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + if: ${{ github.event_name == 'schedule' }} + with: + image-ref: "discordeno/rest-proxy:latest" + exit-code: "0" + vuln-type: "os,library" + severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" + format: "sarif" + output: "trivy-results.sarif" + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + if: ${{ github.event_name == 'schedule' }} + with: + sarif_file: "trivy-results.sarif" + + build-all-arch: + name: Build image for all architectures + needs: build + if: ${{ github.event_name != 'schedule' }} + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v3 + - name: Cache Docker layers + uses: actions/cache@v3 + with: + path: /tmp/.buildx-cache + key: ${{ runner.os }}-single-buildx-${{ github.sha }} + restore-keys: | + ${{ runner.os }}-single-buildx + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + - name: Build Docker image + uses: docker/build-push-action@v4 + with: + context: proxies/rest + push: false + tags: "discordeno/rest-proxy:latest" + # linux/s390x stuck at yarn install, remove it for now + platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le + target: runner + cache-from: type=local,src=/tmp/.buildx-cache + cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max + - # Temp fix + # https://github.com/docker/build-push-action/issues/252 + # https://github.com/moby/buildkit/issues/1896 + name: Move cache + run: | + rm -rf /tmp/.buildx-cache + mv /tmp/.buildx-cache-new /tmp/.buildx-cache publish: name: Publish image - needs: use - if: ${{ github.ref == 'refs/heads/main' }} + needs: build-all-arch + if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }} runs-on: ubuntu-latest permissions: contents: read @@ -62,14 +143,21 @@ jobs: - name: Checkout repository uses: actions/checkout@v3 - name: Log in to the Container registry - uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 + uses: docker/login-action@v2 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 - name: Build and push Docker image - uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc + uses: docker/build-push-action@v4 with: context: proxies/rest push: true tags: "ghcr.io/discordeno/rest-proxy:latest" + # linux/s390x stuck at yarn install, remove it for now + platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le + target: runner diff --git a/proxies/rest/Dockerfile b/proxies/rest/Dockerfile index e6c66df6a..a24811149 100644 --- a/proxies/rest/Dockerfile +++ b/proxies/rest/Dockerfile @@ -5,15 +5,16 @@ # prod-deps: contains only dependencies excluding dev dependencies # runner: the final image, with only the dependencies and compiled files -FROM node:18.15.0-alpine3.17 AS deps +# build only with the platform of the host machine, since it only uses for dev purposes +FROM --platform=$BUILDPLATFORM node:18.15.0-alpine3.17 AS deps WORKDIR /app # copy necessary for install dependencies COPY package.json yarn.lock ./ # install dependencies RUN yarn install -# use node alpine as base image -FROM node:18.15.0-alpine3.17 as builder +# build only with the platform of the host machine, since we just need its files +FROM --platform=$BUILDPLATFORM node:18.15.0-alpine3.17 AS builder # copy the dependencies (node_modules) from the deps image COPY --from=deps /app /app WORKDIR /app @@ -26,7 +27,7 @@ RUN yarn build FROM node:18.15.0-alpine3.17 AS prod-deps WORKDIR /app -# copy necessary for install dependencies +# copy necessary files for install dependencies COPY package.json yarn.lock .yarnrc.yml ./ # config yarn to install only prod dependencies RUN yarn set version berry @@ -34,7 +35,7 @@ RUN yarn plugin import workspace-tools # install prod dependencies RUN yarn workspaces focus --all --production -FROM node:18.15.0-alpine3.17 as runner +FROM node:18.15.0-alpine3.17 AS runner # copy the compiled files from the builder image COPY --from=builder /app/dist /app/dist # copy the prod dependencies (node_modules) from the prod-deps image