Skip to content

Commit ddbbed8

Browse files
JGiolaJGiola
authored
ci: improve pipelines for security + sbom generation (#389)
* build: add devcontainer * feat: add dockerignore * style: add editorconfig * refactor: improved gitignore with gitignore template * build: add support for multiarch in dockerfile * ci: update pipelines
1 parent eda811d commit ddbbed8

File tree

10 files changed

+490
-244
lines changed

10 files changed

+490
-244
lines changed

‎.devcontainer/devcontainer.json

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"name": "Go",
3+
"image": "golang:1.23.2",
4+
"features": {
5+
"ghcr.io/devcontainers/features/common-utils:2": {"username": "golang"},
6+
"ghcr.io/devcontainers/features/docker-in-docker:2": {}
7+
},
8+
"runArgs": [
9+
"--cap-add=SYS_PTRACE",
10+
"--security-opt",
11+
"seccomp=unconfined"
12+
],
13+
"customizations": {
14+
"vscode": {
15+
"settings": {
16+
"files.eol": "\n",
17+
"files.insertFinalNewline": true,
18+
"files.trimFinalNewlines": true,
19+
"files.trimTrailingWhitespace": false,
20+
"go.toolsManagement.checkForUpdates": "local",
21+
"go.useLanguageServer": true,
22+
"go.gopath": "/go",
23+
"go.buildFlags": [
24+
"-tags=conformance,integration"
25+
]
26+
},
27+
"extensions": [
28+
"golang.go",
29+
"redhat.vscode-yaml",
30+
"editorconfig.editorconfig"
31+
]
32+
},
33+
"codespaces": {
34+
"openFiles": [
35+
"README.md",
36+
"CONTRIBUTING.md"
37+
]
38+
}
39+
}
40+
}

‎.dockerignore

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
.devcontainer
2+
.git
3+
.github
4+
.vscode
5+
cache
6+
mocks
7+
.dockerignore
8+
.gitignore
9+
CHANGELOG.md
10+
CODE_OF_CONDUCT.md
11+
CONTRIBUTING.md
12+
coverage.out
13+
Dockerfile
14+
Makefile
15+
output.txt
16+
README.md
17+
SECURITY.md

‎.editorconfig

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
root = true
2+
3+
[*]
4+
indent_style = space
5+
indent_size = tab
6+
end_of_line = lf
7+
charset = utf-8
8+
trim_trailing_whitespace = true
9+
insert_final_newline = true
10+
max_line_length = 120
11+
12+
[*.md]
13+
trim_trailing_whitespace = false
14+
15+
[*.go]
16+
indent_style = tab
17+
18+
[Makefile]
19+
indent_style = tab

‎.github/dependabot.yml

+47-17
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,51 @@
1-
# To get started with Dependabot version updates, you'll need to specify which
2-
# package ecosystems to update and where the package manifests are located.
3-
# Please see the documentation for all configuration options:
4-
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5-
61
version: 2
2+
73
updates:
8-
- package-ecosystem: "gomod"
9-
directory: "/"
10-
schedule:
11-
interval: "daily"
4+
# keep up to date the github actions
5+
- package-ecosystem: github-actions
6+
directory: /
7+
schedule:
8+
interval: monthly
9+
timezone: Europe/Rome
10+
groups:
11+
minor-actions-dependencies:
12+
update-types:
13+
- minor
14+
- patch
15+
commit-message:
16+
include: scope
17+
prefix: ci
18+
19+
# keep up to date the base docker image
20+
- package-ecosystem: docker
21+
directory: /
22+
schedule:
23+
interval: daily
24+
time: "07:00"
25+
timezone: Europe/Rome
26+
commit-message:
27+
include: scope
28+
prefix: build
1229

13-
- package-ecosystem: "github-actions"
14-
directory: "/"
15-
schedule:
16-
interval: "daily"
30+
# enable go dependencies security updates
31+
- directory: /
32+
open-pull-requests-limit: 0
33+
package-ecosystem: gomod
34+
rebase-strategy: auto
35+
schedule:
36+
interval: daily
37+
time: "07:00"
38+
timezone: Europe/Rome
39+
commit-message:
40+
include: scope
41+
prefix: chore
1742

18-
- package-ecosystem: "docker"
19-
directory: "/"
20-
schedule:
21-
interval: "daily"
43+
# keep up to date devcontainers
44+
- package-ecosystem: devcontainers
45+
directory: "/"
46+
schedule:
47+
interval: monthly
48+
timezone: Europe/Rome
49+
commit-message:
50+
include: scope
51+
prefix: build

‎.github/workflows/codeql-analysis.yml

+24-36
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,37 @@
1-
name: "CodeQL"
2-
1+
name: Code Scanning
32
on:
43
push:
5-
branches: [ "main" ]
4+
branches:
5+
- main
6+
tags:
7+
- "*"
68
pull_request:
7-
branches: [ "main" ]
9+
branches:
10+
- main
11+
paths-ignore:
12+
- "**/*.md"
813
schedule:
9-
- cron: '27 19 * * 1'
14+
- cron: 27 19 * * 1
1015

1116
jobs:
12-
analyze:
13-
name: Analyze
14-
runs-on: ubuntu-latest
17+
codeql:
18+
runs-on: macos-latest
1519
permissions:
16-
actions: read
17-
contents: read
1820
security-events: write
19-
20-
strategy:
21-
fail-fast: false
22-
matrix:
23-
language: [ 'go' ]
24-
2521
steps:
2622
- name: Checkout repository
27-
uses: actions/checkout@v4
28-
29-
# Initializes the CodeQL tools for scanning.
23+
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
24+
with:
25+
show-progress: false
26+
- name: Setup Golang
27+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
28+
with:
29+
go-version: 1.23
3030
- name: Initialize CodeQL
31-
uses: github/codeql-action/init@v3
31+
uses: github/codeql-action/init@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
3232
with:
33-
languages: ${{ matrix.language }}
34-
35-
- name: Autobuild
36-
uses: github/codeql-action/autobuild@v3
37-
38-
# ℹ️ Command-line programs to run using the OS shell.
39-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
40-
41-
# If the Autobuild fails above, remove it and uncomment the following three lines.
42-
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
43-
44-
# - run: |
45-
# echo "Run, Build Application using script"
46-
# ./location_of_script_within_repo/buildscript.sh
47-
33+
languages: go
34+
- name: Run Build
35+
run: CGO_ENABLED=0 go build -ldflags="-w -s" -o main .
4836
- name: Perform CodeQL Analysis
49-
uses: github/codeql-action/analyze@v3
37+
uses: github/codeql-action/analyze@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10

‎.github/workflows/release.yml

+11-8
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,18 @@ name: Release
22
on:
33
push:
44
tags:
5-
- '*'
5+
- '*'
6+
67
jobs:
78
release:
89
runs-on: ubuntu-latest
910
steps:
10-
- name: Checkout
11-
uses: actions/checkout@v4
12-
- name: Release
13-
uses: softprops/action-gh-release@v2
14-
with:
15-
generate_release_notes: true
16-
prerelease: ${{ startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-rc.') }}
11+
- name: Checkout repository
12+
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
13+
with:
14+
show-progress: false
15+
- name: Release
16+
uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
17+
with:
18+
generate_release_notes: true
19+
prerelease: ${{ startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-rc.') }}

‎.github/workflows/security.yml

+9-6
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,17 @@ on:
22
pull_request:
33
types: [opened]
44
push:
5+
56
name: Security
67
jobs:
78
gosec:
89
runs-on: ubuntu-latest
910
steps:
10-
- name: Checkout Source
11-
uses: actions/checkout@v4
12-
- name: Run Gosec Security Scanner
13-
uses: securego/gosec@master
14-
with:
15-
args: ./...
11+
- name: Checkout repository
12+
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
13+
with:
14+
show-progress: false
15+
- name: Run Gosec Security Scanner
16+
uses: securego/gosec@master
17+
with:
18+
args: ./...

0 commit comments

Comments
 (0)