feat: introduce re-usable pipelines - #18
Open
moghit-eou wants to merge 16 commits into
Open
moghit-eou wants to merge 16 commits into
moghit-eou wants to merge 16 commits into
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
1 similar comment
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
github.workspace is empty when strategy.matrix is expanded (no runner yet)
Matrix now holds {0} placeholders, filled via format() in job-level env.
All images ran their entrypoint as root, flagged by Semgrep missing-user-entrypoint (ERROR, CWE-250 / CWE-269). Each now drops to an unprivileged account before CMD/ENTRYPOINT. Ownership is set with COPY --chown instead of RUN chown -R. A RUN chown rewrites every touched file into a new layer while the original copy stays in the layer below, so the payload is stored twice. Measured: backend 868MB vs 696MB, frontend 113MB vs 107MB unique. Ref: https://medium.com/@mmornati/docker-images-and-files-chown-40d2f7248fcc
Base image ships openssl 3.5.7-r0 (10 CVEs), Alpine 3.24 has a fixed build. dockerize bundles golang.org/x/crypto 0.57.0 (1 CVE, no fix available yet).
apt upgrade + pip upgrade on the python:3.12.14-slim base. Criticals 6 -> 0 total 91 -> 59. Remainder are Debian packages with no fix available upstream.
hadolint DL4000. MAINTAINER has been deprecated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reusable Pipelines
Introduces reusable pipeline patterns enabling consistent security scanning across multiple projects and stacks. Includes SAST, SCA, and container-scan workflows that operate at both root and per-folder levels.