Skip to content

Commit 14fd54a

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-0000] - add tflint to eps-storage-terraform (#94)
## Summary - Routine Change ### Details - add tflint to eps-storage-terraform
1 parent ebb3846 commit 14fd54a

File tree

11 files changed

+212
-34
lines changed

11 files changed

+212
-34
lines changed

‎.github/workflows/build_all_images.yml‎

Lines changed: 76 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,10 @@ name: build_all_images
1111
NO_CACHE:
1212
required: true
1313
type: boolean
14-
permissions:
15-
attestations: write
16-
contents: read
17-
packages: write
18-
id-token: write
14+
permissions: {}
1915
jobs:
2016
discover_folders:
21-
runs-on: ubuntu-latest
17+
runs-on: ubuntu-22.04
2218
outputs:
2319
base_node_folders: ${{ steps.find-folders.outputs.base_node }}
2420
node_24_language_folders: ${{ steps.find-folders.outputs.node_24_languages }}
@@ -39,8 +35,67 @@ jobs:
3935
echo "projects=$project_folders"
4036
} >> "$GITHUB_OUTPUT"
4137
38+
build_tool_images:
39+
# build common tool images with a lower scoped github token
40+
# as it uses a 3rd party docker image with github cli installed to verify attestation of tflint binary
41+
# and we dont want to make a high scoped token available to that image
42+
# token needs attestation read so it can verify attestation of tflint binary
43+
name: Build tool images for on ${{ matrix.arch }}
44+
runs-on: '${{ matrix.runner }}'
45+
strategy:
46+
fail-fast: false
47+
matrix:
48+
include:
49+
- arch: amd64
50+
runner: ubuntu-22.04
51+
- arch: arm64
52+
runner: ubuntu-22.04-arm
53+
permissions:
54+
contents: read
55+
attestations: read
56+
steps:
57+
- name: Checkout code
58+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
59+
with:
60+
fetch-depth: 0
61+
persist-credentials: false
62+
- name: build_grype
63+
run: |
64+
make build-grype
65+
docker save "local_grype:latest" -o grype_image.tar
66+
- name: build_syft
67+
run: |
68+
make build-syft
69+
docker save "local_syft:latest" -o syft_image.tar
70+
- name: build_grant
71+
run: |
72+
make build-grant
73+
docker save "local_grant:latest" -o grant_image.tar
74+
75+
- name: build_tflint
76+
run: |
77+
make build-tflint
78+
docker save "local_tflint:latest" -o tflint_image.tar
79+
env:
80+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
81+
82+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
83+
name: Upload docker images
84+
with:
85+
name: docker_artifact_${{ matrix.arch }}
86+
path: |
87+
grype_image.tar
88+
syft_image.tar
89+
grant_image.tar
90+
tflint_image.tar
4291
package_base_docker_image:
4392
uses: ./.github/workflows/build_multi_arch_image.yml
93+
permissions:
94+
attestations: write
95+
contents: read
96+
packages: write
97+
id-token: write
98+
needs: [build_tool_images]
4499
with:
45100
tag_latest: ${{ inputs.tag_latest }}
46101
docker_tag: ${{ inputs.docker_tag }}
@@ -51,6 +106,11 @@ jobs:
51106
needs:
52107
- package_base_docker_image
53108
- discover_folders
109+
permissions:
110+
attestations: write
111+
contents: read
112+
packages: write
113+
id-token: write
54114
strategy:
55115
fail-fast: false
56116
matrix:
@@ -68,6 +128,11 @@ jobs:
68128
- package_base_docker_image
69129
- package_base_node_images
70130
- discover_folders
131+
permissions:
132+
attestations: write
133+
contents: read
134+
packages: write
135+
id-token: write
71136
strategy:
72137
fail-fast: false
73138
matrix:
@@ -84,6 +149,11 @@ jobs:
84149
needs:
85150
- package_node_24_language_docker_images
86151
- discover_folders
152+
permissions:
153+
attestations: write
154+
contents: read
155+
packages: write
156+
id-token: write
87157
strategy:
88158
fail-fast: false
89159
matrix:

‎.github/workflows/build_multi_arch_image.yml‎

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,6 @@ jobs:
4141
- arch: arm64
4242
runner: ubuntu-22.04-arm
4343
steps:
44-
- name: Free Disk Space for Docker
45-
uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1
46-
with:
47-
remove_android: true
48-
remove_dotnet: true
49-
remove_haskell: true
50-
remove_tool_cache: true
51-
rm_cmd: rm
52-
remove_packages: >-
53-
azure-cli google-cloud-cli microsoft-edge-stable
54-
google-chrome-stable firefox postgresql* temurin-* *llvm* mysql*
55-
dotnet-sdk-*
56-
remove_packages_one_command: true
5744
- name: Login to github container registry
5845
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
5946
with:
@@ -69,11 +56,30 @@ jobs:
6956
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
7057
with:
7158
node-version: '24.14.0'
59+
- name: docker_artifact download
60+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
61+
with:
62+
name: docker_artifact_${{ matrix.arch }}
63+
path: images/
64+
- name: extract docker images
65+
run: |
66+
for image in images/*.tar; do
67+
docker load -i "$image"
68+
done
69+
rm -rf images
7270
- name: setup syft and grype
7371
run: |
7472
mkdir -p "$RUNNER_TEMP/bin"
75-
docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.syft" src/base/.devcontainer/
76-
docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.grype" src/base/.devcontainer/
73+
id=$(docker create local_grype:latest)
74+
docker cp "$id":/grype - | tar -xOf - grype > "$RUNNER_TEMP/bin/grype"
75+
chmod +x "$RUNNER_TEMP/bin/grype"
76+
docker rm -v "$id"
77+
78+
mkdir -p "$RUNNER_TEMP/bin"
79+
id=$(docker create local_syft:latest)
80+
docker cp "$id":/syft - | tar -xOf - syft > "$RUNNER_TEMP/bin/syft"
81+
chmod +x "$RUNNER_TEMP/bin/syft"
82+
docker rm -v "$id"
7783
echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
7884
- name: make install
7985
run: |

‎.github/workflows/ci.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,13 @@ jobs:
1414
contents: read
1515
packages: read
1616
quality_checks:
17-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
17+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
1818
needs:
1919
- get_config_values
20+
permissions:
21+
contents: read
22+
packages: read
23+
id-token: write
2024
with:
2125
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
2226
secrets:
@@ -35,6 +39,7 @@ jobs:
3539
build_all_images:
3640
needs:
3741
- tag_release
42+
- get_config_values
3843
uses: ./.github/workflows/build_all_images.yml
3944
permissions:
4045
attestations: write

‎.github/workflows/pull_request.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,15 @@ jobs:
2323
contents: read
2424
packages: read
2525
quality_checks:
26-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
26+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
2727
needs:
2828
- get_config_values
2929
with:
3030
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
31+
permissions:
32+
contents: read
33+
packages: read
34+
id-token: write
3135
secrets:
3236
SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}'
3337
pr_title_format_check:
@@ -80,6 +84,7 @@ jobs:
8084
needs:
8185
- get_issue_number
8286
- get_commit_id
87+
- get_config_values
8388
uses: ./.github/workflows/build_all_images.yml
8489
permissions:
8590
attestations: write

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,13 @@ jobs:
1515
contents: read
1616
packages: read
1717
quality_checks:
18-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
18+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
1919
needs:
2020
- get_config_values
21+
permissions:
22+
contents: read
23+
packages: read
24+
id-token: write
2125
with:
2226
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
2327
secrets:
@@ -38,6 +42,7 @@ jobs:
3842
build_all_images:
3943
needs:
4044
- tag_release
45+
- get_config_values
4146
uses: ./.github/workflows/build_all_images.yml
4247
permissions:
4348
attestations: write

‎Makefile‎

Lines changed: 31 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,15 @@ guard-%:
1212

1313
.PHONY: install install-python install-node install-hooks build-base-image build-node-24-image build-node-24-python-3-10-image build-node-24-python-3-12-image build-node-24-python-3-13-image build-node-24-python-3-14-image \
1414
build-eps-storage-terraform-image build-eps-data-extract-image build-fhir-facade-image build-node-24-python-3-14-golang-1-24-image build-node-24-python-3-14-java-24-image \
15-
build-regression-tests-image build-all build-image build-githubactions-image scan-image scan-image-json shell-image lint test lint-githubactions lint-githubaction-scripts clean
15+
build-regression-tests-image build-all build-image build-githubactions-image scan-image scan-image-json shell-image lint test lint-githubactions lint-githubaction-scripts clean \
16+
build-syft build-grype build-grant build-tflint
1617
install: install-python install-node install-hooks
1718

1819
install-python:
1920
poetry install
2021

2122
install-node:
22-
npm install
23+
npm ci --ignore-scripts
2324

2425
install-hooks: install-python
2526
poetry run pre-commit install --install-hooks --overwrite
@@ -43,7 +44,7 @@ build-node-24-python-3-14-image:
4344
CONTAINER_NAME=node_24_python_3_14 BASE_VERSION_TAG=local-build BASE_FOLDER=languages IMAGE_TAG=local-build $(MAKE) build-image
4445

4546
build-eps-storage-terraform-image:
46-
CONTAINER_NAME=eps_storage_terraform BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image
47+
CONTAINER_NAME=eps-storage-terraform BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image
4748

4849
build-eps-data-extract-image:
4950
CONTAINER_NAME=eps_data_extract BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image
@@ -65,14 +66,37 @@ build-all: build-base-image build-node-24-image build-node-24-python-3-10-image
6566
build-regression-tests-image
6667

6768
build-syft:
68-
docker build -f src/base/.devcontainer/Dockerfile.syft --tag local_syft:latest src/base/.devcontainer/
69+
@if docker image inspect local_syft:latest >/dev/null 2>&1; then \
70+
echo "Image local_syft:latest already exists. Skipping build."; \
71+
else \
72+
docker build -f src/base/.devcontainer/Dockerfile.syft --tag local_syft:latest src/base/.devcontainer/; \
73+
fi
6974
build-grype:
70-
docker build -f src/base/.devcontainer/Dockerfile.grype --tag local_grype:latest src/base/.devcontainer/
75+
@if docker image inspect local_grype:latest >/dev/null 2>&1; then \
76+
echo "Image local_grype:latest already exists. Skipping build."; \
77+
else \
78+
docker build -f src/base/.devcontainer/Dockerfile.grype --tag local_grype:latest src/base/.devcontainer/; \
79+
fi
7180

7281
build-grant:
73-
docker build -f src/base/.devcontainer/Dockerfile.grant --tag local_grant:latest src/base/.devcontainer/
82+
@if docker image inspect local_grant:latest >/dev/null 2>&1; then \
83+
echo "Image local_grant:latest already exists. Skipping build."; \
84+
else \
85+
docker build -f src/base/.devcontainer/Dockerfile.grant --tag local_grant:latest src/base/.devcontainer/; \
86+
fi
87+
88+
build-tflint:
89+
@if docker image inspect local_tflint:latest >/dev/null 2>&1; then \
90+
echo "Image local_tflint:latest already exists. Skipping build."; \
91+
else \
92+
docker buildx build \
93+
--secret id=GH_TOKEN,env=GITHUB_TOKEN \
94+
-f src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint \
95+
--tag local_tflint:latest \
96+
src/projects/eps-storage-terraform/.devcontainer/; \
97+
fi
7498

75-
build-image: build-syft build-grype build-grant guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
99+
build-image: build-syft build-grype build-grant build-tflint guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
76100
workspace_folder="$${CONTAINER_NAME}"; \
77101
case "$${CONTAINER_NAME}" in \
78102
eps_*) workspace_folder="$$(printf '%s' "$${CONTAINER_NAME}" | tr '_' '-')" ;; \

‎src/base/.devcontainer/.tool-versions‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
shellcheck 0.11.0
22
direnv 2.37.1
3-
actionlint 1.7.11
3+
actionlint 1.7.12
44
ruby 3.3.0
5-
yq 4.52.4
5+
yq 4.52.5

‎src/projects/eps-storage-terraform/.devcontainer/Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
ARG BASE_VERSION_TAG=latest
22
ARG BASE_IMAGE=ghcr.io/nhsdigital/eps-devcontainers/node_24_python_3_13:${BASE_VERSION_TAG}
33

4+
FROM local_tflint:latest AS tflint-build
45
FROM ${BASE_IMAGE}
56

67
ARG SCRIPTS_DIR=/usr/local/share/eps
@@ -26,6 +27,7 @@ USER root
2627
COPY --chmod=755 scripts ${SCRIPTS_DIR}/${CONTAINER_NAME}
2728
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
2829
RUN ./root_install.sh
30+
COPY --from=tflint-build /tflint /usr/local/bin/tflint
2931

3032
USER vscode
3133

‎src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
FROM serversideup/github-cli:2.89.0 AS build
2+
ARG TARGETARCH
3+
ARG TFLINT_VERSION="v0.61.0"
4+
COPY --chmod=755 scripts/install_tflint.sh /tmp/install_tflint.sh
5+
RUN --mount=type=secret,id=GH_TOKEN,env=GH_TOKEN \
6+
INSTALL_DIR=/tmp/tflint/ \
7+
ARCH="${TARGETARCH}" \
8+
VERSION="${TFLINT_VERSION}" \
9+
/tmp/install_tflint.sh
10+
11+
FROM scratch
12+
COPY --from=build /tmp/tflint/tflint /tflint
13+
ENTRYPOINT ["/tflint"]

0 commit comments

Comments
 (0)