Skip to content

added container scanning to attribute-service repo #132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 20, 2022
Merged

added container scanning to attribute-service repo #132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/workflows/pr-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,18 @@ jobs:
with:
args: build dockerBuildImages

- name: Determine docker tag
id: tag
run: echo ::set-output name=tag::$(./gradlew -q printDockerImageDefaultTag | head -1)

- name: Scan docker image
Copy link
Contributor

@aaron-steinfeld aaron-steinfeld Jul 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we move this into the test job (or give it its own?)

Copy link
Contributor

@ravisingal ravisingal Jul 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is scanning the container image created just before this step. if we move it to another job then we will have to build docker image again.

Copy link
Contributor

@aaron-steinfeld aaron-steinfeld Jul 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess the tradeoff here is we've already built the image vs the test job is the more appropriate place to run this... test. Given that we want to login in order to build the job though, we'd need a new job anyway so I suppose it's moot. Carry on.

Copy link
Contributor

@aaron-steinfeld aaron-steinfeld Jul 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The repetition is less concerning to me - we do 90% of that in the test job to run integration tests, for example. The problem is the secret management - whatever job builds the image needs to be in this workflow (specifically, triggered by pull_request_target rather than pull_request which is what test uses), so we'd need a brand new job if we wanted to separate it which isn't worth it.

uses: azure/[email protected]
with:
image-name: hypertrace/attribute-service:${{ steps.tag.outputs.tag }}
env:
DOCKLE_HOST: "unix:///var/run/docker.sock"
continue-on-error: true

validate-helm-charts:
runs-on: ubuntu-20.04
steps:
Expand Down
4 changes: 2 additions & 2 deletions attribute-service/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ plugins {
java
application
jacoco
id("org.hypertrace.docker-java-application-plugin") version "0.9.0"
id("org.hypertrace.docker-publish-plugin") version "0.9.0"
id("org.hypertrace.docker-java-application-plugin") version "0.9.4"
id("org.hypertrace.docker-publish-plugin") version "0.9.4"
id("org.hypertrace.integration-test-plugin")
id("org.hypertrace.jacoco-report-plugin")
}
Expand Down