Skip to content

New: [AEA-0000] - add syft and grype #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anthony-nhs wants to merge 9 commits into
base: main
Choose a base branch
from
Open

New: [AEA-0000] - add syft and grype #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
aad17bc
add zizmor
anthony-nhs Mar 26, 2026
dd4c7de
Merge remote-tracking branch 'origin/main' into add_script_to_check_g…
anthony-nhs Mar 26, 2026
2e3d943
fix Makefile
anthony-nhs Mar 26, 2026
3afa9b6
install zizmor using pypi
anthony-nhs Mar 26, 2026
07b4ad2
use requirements file
anthony-nhs Mar 26, 2026
3410a72
update following feedback
anthony-nhs Mar 26, 2026
cd72fa6
use later java
anthony-nhs Mar 26, 2026
8c2f0a0
add description of zizmor target
anthony-nhs Mar 26, 2026
5dbf583
add syft and grype
anthony-nhs Mar 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 0 additions & 15 deletions .devcontainer/Dockerfile.bootstrap
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,3 @@
# This can be used to bootstrap devcontainer when no images have been pushed
FROM alpine:3.23.3 AS build
ARG TARGETARCH
RUN apk add --no-cache cosign bash curl jq
COPY src/base/.devcontainer/scripts/install_trivy.sh /tmp/install_trivy.sh
RUN case "${TARGETARCH}" in \
x86_64|amd64) TRIVY_ARCH=64bit ;; \
aarch64|arm64) TRIVY_ARCH=ARM64 ;; \
*) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
esac \
&& INSTALL_DIR=/tmp/trivy/ ARCH="${TRIVY_ARCH}" /tmp/install_trivy.sh


FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
ARG TARGETARCH
ENV TARGETARCH=${TARGETARCH}
Expand Down Expand Up @@ -75,8 +62,6 @@ RUN git clone https://github.com/awslabs/git-secrets.git /tmp/git-secrets && \
chmod 755 /usr/share/secrets-scanner && \
curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o /usr/share/secrets-scanner/nhsd-rules-deny.txt

COPY --from=build /tmp/trivy/trivy /usr/local/bin/trivy

USER vscode

ENV PATH="/home/vscode/.asdf/shims:/home/vscode/.local/bin:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"
Expand Down
62 changes: 28 additions & 34 deletions .github/workflows/build_multi_arch_image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,18 +63,16 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
fetch-depth: 0
# - name: setup trivy
# run: |
# mkdir -p "$RUNNER_TEMP/bin"
# docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.trivy.${ARCH}" .
# echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
# env:
# ARCH: '${{ matrix.arch }}'
- name: setup node
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
with:
node-version: '24.14.0'

- name: setup syft and grype
run: |
mkdir -p "$RUNNER_TEMP/bin"
docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.syft" src/base/.devcontainer/
docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.grype" src/base/.devcontainer/
echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
- name: make install
run: |
make install-node
Expand All @@ -99,32 +97,28 @@ jobs:
CONTAINER_NAME: '${{ inputs.container_name }}'
BASE_FOLDER: "${{ inputs.base_folder }}"
IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
EXIT_CODE: 0
EXTRA_COMMON: "${{ inputs.extra_common }}"
# - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
# name: Upload scan results
# with:
# name: "scan_results_docker_${{ inputs.container_name }}_${{ matrix.arch }}.json"
# path: .out/scan_results_docker.json
# - name: Check docker vulnerabilities - table output
# run: |
# make scan-image
# env:
# CONTAINER_NAME: '${{ inputs.container_name }}'
# BASE_FOLDER: "${{ inputs.base_folder }}"
# IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
# EXIT_CODE: "1"
# EXTRA_COMMON: "${{ inputs.extra_common }}"
# - name: Show docker vulnerability output
# if: always()
# run: |
# echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
# if [ -f .out/scan_results_docker.txt ]; then
# cat .out/scan_results_docker.txt
# fi
# env:
# ARCHITECTURE: '${{ matrix.arch }}'
# DOCKER_TAG: '${{ inputs.docker_tag }}'
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
name: Upload scan results
with:
name: "grype_${{ inputs.container_name }}_${{ matrix.arch }}.json"
path: .grype_out/grype_${{ inputs.container_name }}_${{ matrix.arch }}.json
Comment on lines +103 to +104
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The filename produced by scan-image-json is ./.grype_out/grype_${CONTAINER_NAME}_${IMAGE_TAG}.json, but the workflow later uploads .grype_out/grype_${container_name}_${matrix.arch}.json. With IMAGE_TAG set to ${docker_tag}-${arch}, these paths won’t match, so the upload step will fail. Align the Makefile output name with the workflow expectation (or update the workflow to use the Makefile naming).

Suggested change
name: "grype_${{ inputs.container_name }}_${{ matrix.arch }}.json"
path: .grype_out/grype_${{ inputs.container_name }}_${{ matrix.arch }}.json
name: "grype_${{ inputs.container_name }}_${{ inputs.docker_tag }}-${{ matrix.arch }}.json"
path: .grype_out/grype_${{ inputs.container_name }}_${{ inputs.docker_tag }}-${{ matrix.arch }}.json

Copilot uses AI. Check for mistakes.
- name: Check docker vulnerabilities - text output
run: |
make scan-image
env:
CONTAINER_NAME: '${{ inputs.container_name }}'
BASE_FOLDER: "${{ inputs.base_folder }}"
IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
- name: Show docker vulnerability output
if: always()
run: |
echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
if [ -f .out/scan_results_docker.txt ]; then
cat .out/scan_results_docker.txt
fi
env:
ARCHITECTURE: '${{ matrix.arch }}'
DOCKER_TAG: '${{ inputs.docker_tag }}'
Comment on lines +112 to +121
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The “Show docker vulnerability output” step still checks for .out/scan_results_docker.txt, but make scan-image no longer writes anything to .out/. As written, this step will always print nothing even if the scan finds issues. Either capture grype output to a file (e.g., under .grype_out/) and update this step to cat that file, or remove the step.

Suggested change
- name: Show docker vulnerability output
if: always()
run: |
echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
if [ -f .out/scan_results_docker.txt ]; then
cat .out/scan_results_docker.txt
fi
env:
ARCHITECTURE: '${{ matrix.arch }}'
DOCKER_TAG: '${{ inputs.docker_tag }}'

Copilot uses AI. Check for mistakes.
- name: Push tagged image and rebuild for github actions
run: |
echo "Pushing image..."
Expand Down
Loading
Loading