Build docker images #21
Conversation
This reverts commit 2cbc71a.
| - name: Build ${{ steps.version.outputs.debian_version }} | ||
| if: steps.version.outputs.debian_version != '' | ||
| run: ./ferretdb_packaging/build_packages.sh --os ${{ matrix.os }} --pg ${{ matrix.pg }} --version ${{ steps.version.outputs.debian_version }} --test-clean-install | ||
|
|
||
| - name: Upload | ||
| - name: Upload .deb packages |
Check failure
Code scanning / CodeQL
Cache Poisoning via execution of untrusted code High
Copilot Autofix AI 21 days ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
| - name: Initialize Docker builder | ||
| run: make -C ferretdb_packaging docker-init | ||
|
|
||
| - name: Build local development Docker image |
Check failure
Code scanning / CodeQL
Checkout of untrusted code in trusted context Critical
| path: packaging | ||
|
|
||
| - name: Initialize Docker builder | ||
| run: make -C ferretdb_packaging docker-init |
Check failure
Code scanning / CodeQL
Artifact poisoning Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 21 days ago
To fix the problem, we need to ensure that the contents of the downloaded artifact are extracted to a temporary directory and verified before being used. This can be achieved by creating a temporary directory, extracting the artifact there, and then running the make command with the verified contents.
- Create a temporary directory for extracting the artifact.
- Modify the
actions/download-artifact@v4step to extract the artifact to the temporary directory. - Verify the contents of the extracted artifact.
- Use the verified contents in the
makecommand.
| @@ -193,2 +193,5 @@ | ||
|
|
||
| - name: Create temporary directory for artifacts | ||
| run: mkdir -p ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Download .deb package | ||
| @@ -197,3 +200,12 @@ | ||
| name: deb12-${{ matrix.pg }}-${{ steps.version.outputs.debian_version }} | ||
| path: packaging | ||
| path: ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Verify artifact contents | ||
| run: | | ||
| # Add verification logic here | ||
| # Example: Check if the expected files are present | ||
| if [ ! -f ${{ runner.temp }}/artifacts/expected_file ]; then | ||
| echo "Expected file not found!" | ||
| exit 1 | ||
| fi | ||
|
|
| - name: Build local development Docker image | ||
| if: steps.version.outputs.docker_development_tag_flags != '' | ||
| run: > | ||
| make -C ferretdb_packaging docker-build | ||
| POSTGRES_VERSION=${{ matrix.pg }} | ||
| DOCUMENTDB_VERSION=${{ steps.version.outputs.debian_version }} | ||
| FILE=development | ||
| OUTPUT='type=docker' | ||
| TAGS=${{ steps.version.outputs.docker_development_tag_flags }} | ||
|
|
||
| - name: Build local production Docker image |
Check failure
Code scanning / CodeQL
Checkout of untrusted code in trusted context Critical
| run: > | ||
| make -C ferretdb_packaging docker-build | ||
| POSTGRES_VERSION=${{ matrix.pg }} | ||
| DOCUMENTDB_VERSION=${{ steps.version.outputs.debian_version }} | ||
| FILE=development | ||
| OUTPUT='type=docker' | ||
| TAGS=${{ steps.version.outputs.docker_development_tag_flags }} |
Check failure
Code scanning / CodeQL
Artifact poisoning Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 21 days ago
To fix the artifact poisoning issue, we need to ensure that the contents of the downloaded artifact are extracted to a temporary directory and verified before use. This can be achieved by creating a temporary directory for the artifact extraction and updating the workflow to use this directory. Additionally, we should add verification steps to ensure the integrity of the downloaded artifact.
- Create a temporary directory for artifact extraction.
- Update the
actions/download-artifact@v4step to extract the artifact to the temporary directory. - Add verification steps to ensure the integrity of the downloaded artifact before using it.
| @@ -193,2 +193,5 @@ | ||
|
|
||
| - name: Create temporary directory for artifact | ||
| run: mkdir -p ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Download .deb package | ||
| @@ -197,3 +200,14 @@ | ||
| name: deb12-${{ matrix.pg }}-${{ steps.version.outputs.debian_version }} | ||
| path: packaging | ||
| path: ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Verify downloaded artifact | ||
| run: | | ||
| # Add verification logic here | ||
| echo "Verifying artifact..." | ||
| # Example: Check if the expected file exists | ||
| if [ ! -f "${{ runner.temp }}/artifacts/packaging/deb12-${{ matrix.pg }}-${{ steps.version.outputs.debian_version }}.deb" ]; then | ||
| echo "Artifact verification failed!" | ||
| exit 1 | ||
| fi | ||
| echo "Artifact verified successfully." | ||
|
|
| - name: Build local production Docker image | ||
| if: steps.version.outputs.docker_production_tag_flags != '' | ||
| run: > | ||
| make -C ferretdb_packaging docker-build | ||
| POSTGRES_VERSION=${{ matrix.pg }} | ||
| DOCUMENTDB_VERSION=${{ steps.version.outputs.debian_version }} | ||
| FILE=production | ||
| OUTPUT='type=docker' | ||
| TAGS=${{ steps.version.outputs.docker_production_tag_flags }} | ||
|
|
||
| # - name: Login to Docker Hub | ||
| # uses: docker/login-action@v3 | ||
| # with: | ||
| # username: ferretdbbot | ||
| # password: ${{ secrets.DOCKER_HUB_TOKEN }} | ||
|
|
||
| # - name: Login to GitHub Container Registry | ||
| # uses: docker/login-action@v3 | ||
| # with: | ||
| # registry: ghcr.io | ||
| # username: ${{ github.actor }} | ||
| # password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| # - name: Login to Quay.io | ||
| # uses: docker/login-action@v3 | ||
| # with: | ||
| # registry: quay.io | ||
| # username: ferretdbbot | ||
| # password: ${{ secrets.QUAY_TOKEN }} | ||
|
|
||
| - name: Build and push development Docker images |
Check failure
Code scanning / CodeQL
Checkout of untrusted code in trusted context Critical
| run: > | ||
| make -C ferretdb_packaging docker-build | ||
| POSTGRES_VERSION=${{ matrix.pg }} | ||
| DOCUMENTDB_VERSION=${{ steps.version.outputs.debian_version }} | ||
| FILE=production | ||
| OUTPUT='type=docker' | ||
| TAGS=${{ steps.version.outputs.docker_production_tag_flags }} |
Check failure
Code scanning / CodeQL
Artifact poisoning Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 21 days ago
To fix the problem, we need to ensure that the downloaded artifact is treated as untrusted and extracted to a temporary directory. This prevents any potential malicious content from overriding existing files in the workspace. Additionally, we should verify the contents of the artifact before using it in subsequent steps.
- Create a temporary directory for extracting the artifact.
- Modify the
actions/download-artifactstep to extract the artifact to the temporary directory. - Verify the contents of the artifact before using it.
| @@ -193,2 +193,5 @@ | ||
|
|
||
| - name: Create temporary directory for artifacts | ||
| run: mkdir -p ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Download .deb package | ||
| @@ -197,3 +200,8 @@ | ||
| name: deb12-${{ matrix.pg }}-${{ steps.version.outputs.debian_version }} | ||
| path: packaging | ||
| path: ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Verify artifact contents | ||
| run: | | ||
| # Add verification logic here | ||
| ls ${{ runner.temp }}/artifacts/ | ||
|
|
| - name: Build and push development Docker images | ||
| if: steps.version.outputs.docker_development_tag_flags != '' | ||
| run: > | ||
| make -C ferretdb_packaging docker-build | ||
| POSTGRES_VERSION=${{ matrix.pg }} | ||
| DOCUMENTDB_VERSION=${{ steps.version.outputs.debian_version }} | ||
| FILE=development | ||
| OUTPUT='type=image,push=true' | ||
| TAGS=${{ steps.version.outputs.docker_development_tag_flags }} | ||
|
|
||
| # Build and push Docker images | ||
| - name: Build and push production Docker images |
Check failure
Code scanning / CodeQL
Checkout of untrusted code in trusted context Critical
| run: > | ||
| make -C ferretdb_packaging docker-build | ||
| POSTGRES_VERSION=${{ matrix.pg }} | ||
| DOCUMENTDB_VERSION=${{ steps.version.outputs.debian_version }} | ||
| FILE=development | ||
| OUTPUT='type=image,push=true' | ||
| TAGS=${{ steps.version.outputs.docker_development_tag_flags }} |
Check failure
Code scanning / CodeQL
Artifact poisoning Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 21 days ago
To fix the problem, we need to ensure that the contents of the downloaded artifact are extracted to a temporary directory and verified before being used. This can be achieved by creating a temporary directory, extracting the artifact there, and then using the extracted files from the temporary directory.
- Create a temporary directory for extracting the artifact.
- Modify the
actions/download-artifact@v4step to extract the artifact to the temporary directory. - Update subsequent steps to use the files from the temporary directory.
| @@ -193,2 +193,5 @@ | ||
|
|
||
| - name: Create temporary directory for artifacts | ||
| run: mkdir -p ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Download .deb package | ||
| @@ -197,3 +200,3 @@ | ||
| name: deb12-${{ matrix.pg }}-${{ steps.version.outputs.debian_version }} | ||
| path: packaging | ||
| path: ${{ runner.temp }}/artifacts/ | ||
|
|
||
| @@ -245,3 +248,3 @@ | ||
| run: > | ||
| make -C ferretdb_packaging docker-build | ||
| make -C ${{ runner.temp }}/artifacts/ferretdb_packaging docker-build | ||
| POSTGRES_VERSION=${{ matrix.pg }} |
| run: > | ||
| make -C ferretdb_packaging docker-build | ||
| POSTGRES_VERSION=${{ matrix.pg }} | ||
| DOCUMENTDB_VERSION=${{ steps.version.outputs.debian_version }} | ||
| FILE=production | ||
| OUTPUT='type=image,push=true' | ||
| TAGS=${{ steps.version.outputs.docker_production_tag_flags }} |
Check failure
Code scanning / CodeQL
Artifact poisoning Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 21 days ago
To fix the problem, we need to ensure that the contents of the downloaded artifacts are extracted to a temporary directory and verified before use. This prevents any potential malicious artifacts from overriding existing files or executing untrusted code.
- Create a temporary directory for extracting the artifact.
- Modify the
actions/download-artifactstep to extract the artifact to the temporary directory. - Verify the contents of the artifact before using it in subsequent steps.
| @@ -193,2 +193,5 @@ | ||
|
|
||
| - name: Create temporary directory for artifacts | ||
| run: mkdir -p ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Download .deb package | ||
| @@ -197,3 +200,12 @@ | ||
| name: deb12-${{ matrix.pg }}-${{ steps.version.outputs.debian_version }} | ||
| path: packaging | ||
| path: ${{ runner.temp }}/artifacts/ | ||
|
|
||
| - name: Verify artifact contents | ||
| run: | | ||
| # Add verification logic here | ||
| # Example: Check if the expected files are present | ||
| if [ ! -f "${{ runner.temp }}/artifacts/expected_file.deb" ]; then | ||
| echo "Expected file not found in the artifact" | ||
| exit 1 | ||
| fi | ||
|
|
There was a problem hiding this comment.
PR Overview
This PR introduces improvements to our Docker image build process while refactoring version‐extraction functions. Key changes include adding tests for Docker image URLs and summaries, refactoring and renaming of version/differentiation functions (for PR, branch, and tag events), and updating GitHub Actions workflows to use the new output naming conventions.
Reviewed Changes
| File | Description |
|---|---|
| ferretdb_packaging/defineversion/debian_test.go | Adds a test for reading the default version from control files. |
| ferretdb_packaging/defineversion/debian.go | Implements version extraction and Debian version formatting. |
| ferretdb_packaging/defineversion/docker_test.go | Covers Docker URL generation and Docker summary output testing. |
| .github/workflows/ferretdb_packages.yml | Updates workflow steps with new version output variables and build steps for Docker images. |
| ferretdb_packaging/buildkitd.toml | Disables garbage collection for BuildKit workers. |
| ferretdb_packaging/defineversion/main.go | Refactors main version command; consolidates and renames functions. |
| ferretdb_packaging/defineversion/main_test.go | Updates tests to reflect new parsing and output logic. |
| ferretdb_packaging/defineversion/docker.go | Refactors Docker-related functions and URL mapping logic. |
Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.
Comments suppressed due to low confidence (3)
ferretdb_packaging/defineversion/main.go:44
- [nitpick] Consider clarifying the error message when the prerelease does not start with 'ferretdb-'. For example, update it to 'git tag must include a prerelease part starting with "ferretdb-" following the format v-ferretdb-' to guide correct tag usage.
if !strings.HasPrefix(prerelease, "ferretdb-") {
ferretdb_packaging/defineversion/main_test.go:50
- Consider adding a test case in TestParseGitTag for git tags that include build metadata (non-empty buildmetadata) to ensure that the error 'buildmetadata "%q" is present' is properly triggered.
major, minor, patch, prerelease, err := parseGitTag(tag)
.github/workflows/ferretdb_packages.yml:105
- Ensure the renamed output variable 'debian_version' is consistently used in all subsequent workflow steps to prevent mismatches with previous naming conventions.
- name: Define version
|
@AlekSi this pull request has merge conflicts. |
# Conflicts: # .github/workflows/ferretdb_packages.yml
|
|
No description provided.