Merge branch 'main' into modulesync

voxpupuli · Nov 7, 2024 · c24ccf0 · c24ccf0
2 parents 4bc9158 + c23e689
commit c24ccf0
Show file tree

Hide file tree

Showing 9 changed files with 383 additions and 76 deletions.
diff --git a/.github/workflows/build_container.yml b/.github/workflows/build_container.yml
@@ -21,8 +21,43 @@ jobs:
       - id: set-matrix
         run: echo "matrix=$(jq -c . build_versions.json)" >> $GITHUB_OUTPUT
 
-  build-and-push-container:
-    runs-on: ubuntu-latest
+  build-X86-container:
+    runs-on: macarne
+    permissions:
+      contents: read
+      packages: write
+    needs: setup-matrix
+    strategy:
+      matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
+    steps:
+      - name: Build Vox Pupuli Test Box r${{ matrix.puppet_release }}
+        uses: voxpupuli/gha-build-and-publish-a-container@v2
+        with:
+          registry_password: ${{ secrets.GITHUB_TOKEN }}
+          build_args: |
+            BASE_IMAGE=${{ matrix.base_image }}
+            RUBYGEM_PUPPET=${{ matrix.rubygem_puppet }}
+            RUBYGEM_FACTER=${{ matrix.rubygem_facter }}
+            RUBYGEM_VOXPUPULI_TEST=${{ matrix.rubygem_voxpupuli_test }}
+            RUBYGEM_VOXPUPULI_ACCEPTANCE=${{ matrix.rubygem_voxpupuli_acceptance }}
+            RUBYGEM_VOXPUPULI_RELEASE=${{ matrix.rubygem_voxpupuli_release }}
+            RUBYGEM_PUPPET_METADATA=${{ matrix.rubygem_puppet_metadata }}
+            RUBYGEM_MODULESYNC=${{ matrix.rubygem_modulesync }}
+            RUBYGEM_RUBOCOP_PERFORMANCE=${{ matrix.rubygem_rubocop_performance }}
+            RUBYGEM_BUNDLER=${{ matrix.rubygem_bundler }}
+            APK_JQ=${{ matrix.apk_jq }}
+            APK_YAMLLINT=${{ matrix.apk_yamllint }}
+            APK_GIT=${{ matrix.apk_git }}
+            APK_CURL=${{ matrix.apk_curl }}
+          build_arch: linux/amd64
+          docker_username: voxpupulibot
+          docker_password: ${{ secrets.DOCKERHUB_BOT_PASSWORD }}
+          tags: |
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+  build-ARM-container:
+    runs-on: hetzner-arm
     permissions:
       contents: read
       packages: write
@@ -44,18 +79,82 @@ jobs:
             RUBYGEM_PUPPET_METADATA=${{ matrix.rubygem_puppet_metadata }}
             RUBYGEM_MODULESYNC=${{ matrix.rubygem_modulesync }}
             RUBYGEM_RUBOCOP_PERFORMANCE=${{ matrix.rubygem_rubocop_performance }}
-          build_arch: linux/amd64,linux/arm64
+            RUBYGEM_BUNDLER=${{ matrix.rubygem_bundler }}
+            APK_JQ=${{ matrix.apk_jq }}
+            APK_YAMLLINT=${{ matrix.apk_yamllint }}
+            APK_GIT=${{ matrix.apk_git }}
+            APK_CURL=${{ matrix.apk_curl }}
+          build_arch: linux/arm64
           docker_username: voxpupulibot
           docker_password: ${{ secrets.DOCKERHUB_BOT_PASSWORD }}
           tags: |
-            ghcr.io/voxpupuli/voxbox:${{ matrix.rubygem_puppet }}-${{ github.ref_name }}
-            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.ref_name }}
-            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}
-            ghcr.io/voxpupuli/voxbox:latest
-            docker.io/voxpupuli/voxbox:${{ matrix.rubygem_puppet }}-${{ github.ref_name }}
-            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.ref_name }}
-            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}
-            docker.io/voxpupuli/voxbox:latest
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64
+
+  create-multiarch-manifests:
+    runs-on: ubuntu-latest
+    needs:
+      - setup-matrix
+      - build-X86-container
+      - build-ARM-container
+    strategy:
+      matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
+    steps:
+      - name: Log in to the ghcr.io registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to the docker.io registry
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: voxpupulibot
+          password: ${{ secrets.DOCKERHUB_BOT_PASSWORD }}
+
+      - name: Create multiarch manifests
+        run: |
+          docker buildx imagetools create -t ghcr.io/voxpupuli/voxbox:${{ matrix.rubygem_puppet }}-${{ github.ref_name }} \
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64 \
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+          docker buildx imagetools create -t ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.ref_name }} \
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64 \
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+          docker buildx imagetools create -t ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }} \
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64 \
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+          docker buildx imagetools create -t ghcr.io/voxpupuli/voxbox:latest \
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64 \
+            ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+          docker buildx imagetools create -t docker.io/voxpupuli/voxbox:${{ matrix.rubygem_puppet }}-${{ github.ref_name }} \
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64 \
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+          docker buildx imagetools create -t docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.ref_name }} \
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64 \
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+          docker buildx imagetools create -t docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }} \
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64 \
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+          docker buildx imagetools create -t docker.io/voxpupuli/voxbox:latest \
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-arm64 \
+            docker.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-${{ github.sha }}-x86
+
+  update-dockerhub-description:
+    runs-on: ubuntu-latest
+    needs:
+      - create-multiarch-manifests
+    steps:
+      - name: Source checkout
+        uses: actions/checkout@v4
 
       - name: Update Docker Hub Description
         uses: peter-evans/dockerhub-description@v4

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -19,9 +19,9 @@ jobs:
       - id: set-matrix
         run: echo "matrix=$(jq -c . build_versions.json)" >> $GITHUB_OUTPUT
 
-  build_test_container:
-    name: 'Build test container'
-    runs-on: ubuntu-latest
+  build-x86-container:
+    name: 'Build x86 CI container'
+    runs-on: macarne
     permissions:
       actions: read
       contents: read
@@ -49,37 +49,66 @@ jobs:
             RUBYGEM_PUPPET_METADATA=${{ matrix.rubygem_puppet_metadata }}
             RUBYGEM_OVERCOMMIT=${{ matrix.rubygem_overcommit }}
             RUBYGEM_MODULESYNC=${{ matrix.rubygem_modulesync }}
+            RUBYGEM_BUNDLER=${{ matrix.rubygem_bundler }}
+            APK_JQ=${{ matrix.apk_jq }}
+            APK_YAMLLINT=${{ matrix.apk_yamllint }}
+            APK_GIT=${{ matrix.apk_git }}
+            APK_CURL=${{ matrix.apk_curl }}
 
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+      - name: Clone voxpupuli/puppet-example repository
+        uses: actions/checkout@v4
         with:
-          username: voxpupulibot
-          password: ${{ secrets.DOCKERHUB_BOT_PASSWORD }}
+          repository: voxpupuli/puppet-example
 
-      - name: Analyze container image for CVEs
-        id: analyze-image-cves
-        uses: docker/scout-action@v1
-        with:
-          command: cves
-          image: 'local://ci/voxbox:${{ matrix.rubygem_puppet }}'
-          sarif-file: sarif.output.${{ matrix.rubygem_puppet }}.${{ github.sha }}.json
-          write-comment: false
+      - name: Test container
+        run: |
+          # get ids from runner user
+          RUNNER_UID=$(id -u)
+          RUNNER_GID=$(id -g)
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile -T
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile lint
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile metadata_lint
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile strings:validate:reference
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile rubocop
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile syntax
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile spec
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile r10k:syntax
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile r10k:dependencies
 
-      - name: Compare container image to latest from Registry
-        id: compare-image
-        uses: docker/scout-action@v1
-        with:
-          command: compare
-          image: 'local://ci/voxbox:${{ matrix.rubygem_puppet }}'
-          to: 'ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-main'
-          summary: true
-          keep-previous-comments: true
+  build-ARM-container:
+    name: 'Build ARM CI container'
+    runs-on: hetzner-arm
+    permissions:
+      actions: read
+      contents: read
+    needs: setup-matrix
+    strategy:
+      matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-      - name: Upload SARIF result
-        id: upload-sarif
-        uses: github/codeql-action/upload-sarif@v3
+      - name: Build image
+        uses: docker/build-push-action@v6
         with:
-          sarif_file: sarif.output.${{ matrix.rubygem_puppet }}.${{ github.sha }}.json
+          tags: 'ci/voxbox:${{ matrix.rubygem_puppet }}'
+          push: false
+          platforms: linux/arm64
+          build-args: |
+            BASE_IMAGE=${{ matrix.base_image }}
+            RUBYGEM_PUPPET=${{ matrix.rubygem_puppet }}
+            RUBYGEM_FACTER=${{ matrix.facter_version }}
+            RUBYGEM_VOXPUPULI_TEST=${{ matrix.rubygem_voxpupuli_test }}
+            RUBYGEM_VOXPUPULI_ACCEPTANCE=${{ matrix.rubygem_voxpupuli_acceptance }}
+            RUBYGEM_VOXPUPULI_RELEASE=${{ matrix.rubygem_voxpupuli_release }}
+            RUBYGEM_PUPPET_METADATA=${{ matrix.rubygem_puppet_metadata }}
+            RUBYGEM_OVERCOMMIT=${{ matrix.rubygem_overcommit }}
+            RUBYGEM_MODULESYNC=${{ matrix.rubygem_modulesync }}
+            RUBYGEM_BUNDLER=${{ matrix.rubygem_bundler }}
+            APK_JQ=${{ matrix.apk_jq }}
+            APK_YAMLLINT=${{ matrix.apk_yamllint }}
+            APK_GIT=${{ matrix.apk_git }}
+            APK_CURL=${{ matrix.apk_curl }}
 
       - name: Clone voxpupuli/puppet-example repository
         uses: actions/checkout@v4
@@ -88,20 +117,45 @@ jobs:
 
       - name: Test container
         run: |
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile -T
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile lint
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile metadata_lint
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile strings:validate:reference
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile rubocop
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile syntax
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile spec
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile r10k:syntax
-          docker run --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile r10k:dependencies
+          # get ids from runner user
+          RUNNER_UID=$(id -u)
+          RUNNER_GID=$(id -g)
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile -T
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile lint
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile metadata_lint
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile strings:validate:reference
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile rubocop
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile syntax
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile spec
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile r10k:syntax
+          docker run --user ${RUNNER_UID}:${RUNNER_GID} --rm  -v $(pwd):/repo ci/voxbox:${{ matrix.rubygem_puppet }} -f /Rakefile r10k:dependencies
 
   tests:
     needs:
-      - build_test_container
+      - build-x86-container
+      - build-ARM-container
     runs-on: ubuntu-latest
     name: Test suite
     steps:
       - run: echo Test suite completed
+
+  dependabot:
+    permissions:
+      contents: write
+    name: 'Dependabot auto-merge'
+    needs:
+      - tests
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'}}
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/[email protected]
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+
+      - name: Enable auto-merge for Dependabot PRs
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
diff --git a/.github/workflows/security_scanning.yml b/.github/workflows/security_scanning.yml
@@ -0,0 +1,72 @@
+---
+name: Security Scanning 🕵️
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  setup-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Source checkout
+        uses: actions/checkout@v4
+
+      - id: set-matrix
+        run: echo "matrix=$(jq -c . build_versions.json)" >> $GITHUB_OUTPUT
+
+  scan_ci_container:
+    name: 'Scan CI container'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    needs: setup-matrix
+    strategy:
+      matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Build CI container
+        uses: docker/build-push-action@v6
+        with:
+          tags: 'ci/voxbox:${{ matrix.rubygem_puppet }}'
+          push: false
+          build-args: |
+            BASE_IMAGE=${{ matrix.base_image }}
+            RUBYGEM_PUPPET=${{ matrix.rubygem_puppet }}
+            RUBYGEM_FACTER=${{ matrix.facter_version }}
+            RUBYGEM_VOXPUPULI_TEST=${{ matrix.rubygem_voxpupuli_test }}
+            RUBYGEM_VOXPUPULI_ACCEPTANCE=${{ matrix.rubygem_voxpupuli_acceptance }}
+            RUBYGEM_VOXPUPULI_RELEASE=${{ matrix.rubygem_voxpupuli_release }}
+            RUBYGEM_PUPPET_METADATA=${{ matrix.rubygem_puppet_metadata }}
+            RUBYGEM_OVERCOMMIT=${{ matrix.rubygem_overcommit }}
+            RUBYGEM_MODULESYNC=${{ matrix.rubygem_modulesync }}
+            RUBYGEM_BUNDLER=${{ matrix.rubygem_bundler }}
+            APK_JQ=${{ matrix.apk_jq }}
+            APK_YAMLLINT=${{ matrix.apk_yamllint }}
+            APK_GIT=${{ matrix.apk_git }}
+            APK_CURL=${{ matrix.apk_curl }}
+
+      - name: Scan image with Anchore Grype
+        uses: anchore/scan-action@v5
+        id: scan
+        with:
+          image: 'ci/voxbox:${{ matrix.rubygem_puppet }}'
+          fail-build: false
+
+      - name: Inspect action SARIF report
+        run: jq . ${{ steps.scan.outputs.sarif }}
+
+      - name: Upload Anchore scan SARIF report
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,25 @@
 
 All notable changes to this project will be documented in this file.
 
+## [v2.2.0](https://github.com/voxpupuli/container-voxbox/tree/v2.2.0) (2024-09-16)
+
+[Full Changelog](https://github.com/voxpupuli/container-voxbox/compare/v2.1.0...v2.2.0)
+
+**Implemented enhancements:**
+
+- feat: re-enable by puppetlabs disabled puppet-lint checks [\#48](https://github.com/voxpupuli/container-voxbox/pull/48) ([rwaffen](https://github.com/rwaffen))
+- fix: update bundler, fix cve in voxbox7 [\#45](https://github.com/voxpupuli/container-voxbox/pull/45) ([rwaffen](https://github.com/rwaffen))
+- fix: in ruby 2.7 rexml is a default gem [\#42](https://github.com/voxpupuli/container-voxbox/pull/42) ([rwaffen](https://github.com/rwaffen))
+- Fix: update CVE infested gems [\#41](https://github.com/voxpupuli/container-voxbox/pull/41) ([rwaffen](https://github.com/rwaffen))
+
+**Fixed bugs:**
+
+- fix: update broken facter reference in build [\#46](https://github.com/voxpupuli/container-voxbox/pull/46) ([rwaffen](https://github.com/rwaffen))
+
+**Merged pull requests:**
+
+- doc: add info about additionally included tools [\#39](https://github.com/voxpupuli/container-voxbox/pull/39) ([rwaffen](https://github.com/rwaffen))
+
 ## [v2.1.0](https://github.com/voxpupuli/container-voxbox/tree/v2.1.0) (2024-08-21)
 
 [Full Changelog](https://github.com/voxpupuli/container-voxbox/compare/v2.0.0...v2.1.0)