Skip to content

Commit 4325c48

Browse files
anthony-nhsanthony-nhs
authored
New: [AEA-0000] - add anchore tools (#69)
## Summary - Routine Change ### Details - add syft - add grype - add grant
1 parent abfdd2f commit 4325c48

File tree

36 files changed

+1093
-81
lines changed

36 files changed

+1093
-81
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,6 @@
2222
"--network=host"
2323
],
2424
"remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" },
25-
"postCreateCommand": "bash ${SCRIPTS_DIR}/post_create.sh",
26-
"postStartCommand": "bash ${SCRIPTS_DIR}/post_start.sh",
27-
"postAttachCommand": "bash ${SCRIPTS_DIR}/post_attach.sh",
2825
"features": {
2926
},
3027
"customizations": {

‎.github/dependabot.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ updates:
1616
open-pull-requests-limit: 20
1717
commit-message:
1818
prefix: "Upgrade: [dependabot] - "
19-
19+
cooldown:
20+
default-days: 7
2021
###################################
2122
# NPM workspace ##################
2223
###################################
@@ -30,6 +31,8 @@ updates:
3031
versioning-strategy: increase
3132
commit-message:
3233
prefix: "Upgrade: [dependabot] - "
34+
cooldown:
35+
default-days: 7
3336

3437
###################################
3538
# Poetry #########################
@@ -44,3 +47,5 @@ updates:
4447
versioning-strategy: increase
4548
commit-message:
4649
prefix: "Upgrade: [dependabot] - "
50+
cooldown:
51+
default-days: 7

‎.github/workflows/build_all_images.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,11 @@ name: build_all_images
1111
NO_CACHE:
1212
required: true
1313
type: boolean
14-
env:
15-
BRANCH_NAME: '${{ github.event.pull_request.head.ref }}'
14+
permissions:
15+
attestations: write
16+
contents: read
17+
packages: write
18+
id-token: write
1619
jobs:
1720
discover_folders:
1821
runs-on: ubuntu-latest
@@ -22,6 +25,8 @@ jobs:
2225
project_folders: ${{ steps.find-folders.outputs.projects }}
2326
steps:
2427
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
28+
with:
29+
persist-credentials: false
2530

2631
- id: find-folders
2732
run: |

‎.github/workflows/build_multi_arch_image.yml‎

Lines changed: 20 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ name: Build and push docker image
2020
EXTRA_COMMON:
2121
required: false
2222
type: string
23+
permissions: {}
2324

2425
jobs:
2526
build_and_push_image:
@@ -63,11 +64,17 @@ jobs:
6364
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
6465
with:
6566
fetch-depth: 0
67+
persist-credentials: false
6668
- name: setup node
6769
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
6870
with:
6971
node-version: '24.14.0'
70-
72+
- name: setup syft and grype
73+
run: |
74+
mkdir -p "$RUNNER_TEMP/bin"
75+
docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.syft" src/base/.devcontainer/
76+
docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.grype" src/base/.devcontainer/
77+
echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
7178
- name: make install
7279
run: |
7380
make install-node
@@ -92,32 +99,18 @@ jobs:
9299
CONTAINER_NAME: '${{ inputs.container_name }}'
93100
BASE_FOLDER: "${{ inputs.base_folder }}"
94101
IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
95-
EXIT_CODE: 0
96-
EXTRA_COMMON: "${{ inputs.extra_common }}"
97-
# - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
98-
# name: Upload scan results
99-
# with:
100-
# name: "scan_results_docker_${{ inputs.container_name }}_${{ matrix.arch }}.json"
101-
# path: .out/scan_results_docker.json
102-
# - name: Check docker vulnerabilities - table output
103-
# run: |
104-
# make scan-image
105-
# env:
106-
# CONTAINER_NAME: '${{ inputs.container_name }}'
107-
# BASE_FOLDER: "${{ inputs.base_folder }}"
108-
# IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
109-
# EXIT_CODE: "1"
110-
# EXTRA_COMMON: "${{ inputs.extra_common }}"
111-
# - name: Show docker vulnerability output
112-
# if: always()
113-
# run: |
114-
# echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
115-
# if [ -f .out/scan_results_docker.txt ]; then
116-
# cat .out/scan_results_docker.txt
117-
# fi
118-
# env:
119-
# ARCHITECTURE: '${{ matrix.arch }}'
120-
# DOCKER_TAG: '${{ inputs.docker_tag }}'
102+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
103+
name: Upload scan results
104+
with:
105+
name: "grype_${{ inputs.container_name }}_${{ inputs.docker_tag }}-${{ matrix.arch }}.json"
106+
path: .grype_out/grype_${{ inputs.container_name }}_${{ inputs.docker_tag }}-${{ matrix.arch }}.json
107+
- name: Check docker vulnerabilities - text output
108+
run: |
109+
make scan-image
110+
env:
111+
CONTAINER_NAME: '${{ inputs.container_name }}'
112+
BASE_FOLDER: "${{ inputs.base_folder }}"
113+
IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
121114
- name: Push tagged image and rebuild for github actions
122115
run: |
123116
echo "Pushing image..."

‎.github/workflows/ci.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,17 @@ name: merge to main workflow
22
on:
33
push:
44
branches: [main]
5+
permissions: {}
56

67
jobs:
78
get_config_values:
89
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
910
with:
1011
verify_published_from_main_image: true
12+
permissions:
13+
attestations: read
14+
contents: read
15+
packages: read
1116
quality_checks:
1217
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
1318
needs:
@@ -27,11 +32,15 @@ jobs:
2732
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
2833
branch_name: main
2934
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
30-
secrets: inherit
3135
build_all_images:
3236
needs:
3337
- tag_release
3438
uses: ./.github/workflows/build_all_images.yml
39+
permissions:
40+
attestations: write
41+
contents: read
42+
packages: write
43+
id-token: write
3544
with:
3645
docker_tag: 'ci-${{ needs.tag_release.outputs.version_tag }}'
3746
tag_latest: false

‎.github/workflows/delete_old_images.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ on:
77
- cron: "0 1 * * 6"
88
push:
99
branches: [main]
10+
permissions: {}
1011

1112
jobs:
1213
delete-old-pushed-images:
@@ -21,8 +22,8 @@ jobs:
2122
- name: Checkout local code
2223
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2324
with:
24-
ref: ${{ env.BRANCH_NAME }}
2525
fetch-depth: 0
26+
persist-credentials: false
2627

2728
- name: delete unused images
2829
shell: bash

‎.github/workflows/pull_request.yml‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,25 @@ name: pull_request
33
pull_request:
44
branches:
55
- main
6-
env:
7-
BRANCH_NAME: '${{ github.event.pull_request.head.ref }}'
6+
permissions: {}
87
jobs:
98
dependabot-auto-approve-and-merge:
109
needs: quality_checks
11-
uses: >-
12-
NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
10+
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
11+
permissions:
12+
contents: write
13+
pull-requests: write
1314
secrets:
1415
AUTOMERGE_APP_ID: '${{ secrets.AUTOMERGE_APP_ID }}'
1516
AUTOMERGE_PEM: '${{ secrets.AUTOMERGE_PEM }}'
1617
get_config_values:
1718
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
1819
with:
1920
verify_published_from_main_image: false
21+
permissions:
22+
attestations: read
23+
contents: read
24+
packages: read
2025
quality_checks:
2126
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
2227
needs:
@@ -26,8 +31,9 @@ jobs:
2631
secrets:
2732
SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}'
2833
pr_title_format_check:
29-
uses: >-
30-
NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
34+
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
35+
permissions:
36+
pull-requests: write
3137
get_issue_number:
3238
runs-on: ubuntu-22.04
3339
needs: quality_checks
@@ -63,7 +69,7 @@ jobs:
6369
- name: Checkout code
6470
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
6571
with:
66-
ref: '${{ env.BRANCH_NAME }}'
72+
persist-credentials: false
6773
- name: Get Commit ID
6874
id: commit_id
6975
run: |
@@ -75,6 +81,11 @@ jobs:
7581
- get_issue_number
7682
- get_commit_id
7783
uses: ./.github/workflows/build_all_images.yml
84+
permissions:
85+
attestations: write
86+
contents: read
87+
packages: write
88+
id-token: write
7889
with:
7990
docker_tag: 'pr-${{ needs.get_issue_number.outputs.issue_number }}-${{ needs.get_commit_id.outputs.sha_short }}'
8091
tag_latest: false

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,17 @@ on:
33
workflow_dispatch:
44
schedule:
55
- cron: "0 18 * * 3"
6+
permissions: {}
67

78
jobs:
89
get_config_values:
910
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
1011
with:
1112
verify_published_from_main_image: false
13+
permissions:
14+
attestations: read
15+
contents: read
16+
packages: read
1217
quality_checks:
1318
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
1419
needs:
@@ -34,6 +39,11 @@ jobs:
3439
needs:
3540
- tag_release
3641
uses: ./.github/workflows/build_all_images.yml
42+
permissions:
43+
attestations: write
44+
contents: read
45+
packages: write
46+
id-token: write
3747
with:
3848
docker_tag: '${{ needs.tag_release.outputs.version_tag }}'
3949
tag_latest: true

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ src/base/.devcontainer/language_versions/
44
.trivyignore_combined.yaml
55
.out/
66
.envrc
7+
.sbom/
78
.grype_out/

‎.grype.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
ignore:
2+
# base image
3+
- vulnerability: CVE-2025-4517
4+
- vulnerability: CVE-2025-68121
5+
- vulnerability: GHSA-p77j-4mvh-x3m3
6+
- vulnerability: GHSA-vmwr-mc7x-5vc3
7+
- vulnerability: CVE-2025-4330
8+
- vulnerability: CVE-2025-4435
9+
- vulnerability: CVE-2025-4138
10+
- vulnerability: CVE-2025-8194
11+
- vulnerability: CVE-2025-13836
12+
- vulnerability: CVE-2024-9287
13+
- vulnerability: CVE-2025-61726
14+
- vulnerability: CVE-2026-4519
15+
- vulnerability: CVE-2026-25679
16+
- vulnerability: CVE-2025-61725
17+
- vulnerability: CVE-2025-61723
18+
- vulnerability: CVE-2025-61729
19+
- vulnerability: GHSA-4vrq-3vrq-g6gg
20+
- vulnerability: CVE-2025-58187
21+
- vulnerability: CVE-2026-27137
22+
- vulnerability: CVE-2025-47907
23+
- vulnerability: CVE-2025-61731
24+
- vulnerability: GHSA-9h8m-3fm2-qjrq
25+
- vulnerability: CVE-2025-61732
26+
- vulnerability: GHSA-4c29-8rgm-jvjj
27+
- vulnerability: CVE-2025-58188
28+
- vulnerability: CVE-2025-4674
29+
- vulnerability: GHSA-x744-4wpc-v9h2
30+
# node_24 vulnerabilities
31+
- vulnerability: GHSA-c2c7-rcm5-vvqj
32+
- vulnerability: GHSA-7r86-cg39-jmmj
33+
- vulnerability: GHSA-3ppc-4f35-3m26
34+
- vulnerability: GHSA-23c5-xmqv-rm74
35+
- vulnerability: GHSA-9ppj-qmqm-q256
36+
- vulnerability: GHSA-qffp-2rhf-9h96
37+
- vulnerability: GHSA-83g3-92jg-28cx
38+
# node_24_python_3_10 vulnerabilities
39+
- vulnerability: GHSA-cx63-2mw6-8hw5
40+
- vulnerability: GHSA-r9hx-vwmv-q579
41+
- vulnerability: GHSA-5rjg-fvgr-3xxf
42+
# eps-storage-terraform vulnerabilities
43+
- vulnerability: CVE-2025-68119
44+
# eps-data-extract vulnerabilities
45+
- vulnerability: GHSA-6fmv-xxpf-w3cw
46+
# fhir-facade vulnerabilities
47+
- vulnerability: CVE-2022-26485
48+
- vulnerability: CVE-2022-26486
49+
- vulnerability: CVE-2022-25235
50+
- vulnerability: CVE-2022-25236
51+
- vulnerability: CVE-2024-21147
52+
- vulnerability: CVE-2025-21587
53+
- vulnerability: CVE-2025-30749
54+
- vulnerability: CVE-2024-20952
55+
- vulnerability: CVE-2024-20918
56+
- vulnerability: CVE-2025-50106
57+
- vulnerability: CVE-2025-50059
58+
- vulnerability: CVE-2025-53066
59+
- vulnerability: CVE-2026-21945
60+
- vulnerability: CVE-2026-21932
61+
# node-24_python_3_14_java_24 vulnerabilities
62+
- vulnerability: GHSA-6fmv-xxpf-w3cw
63+
- vulnerability: CVE-2025-53066
64+
- vulnerability: CVE-2026-21945
65+
- vulnerability: CVE-2026-21932

0 commit comments

Comments
 (0)