From b360cf167d23f8c1b7d9c0e0af9862a9d891080d Mon Sep 17 00:00:00 2001 From: dwith Date: Mon, 17 Nov 2025 18:05:54 -0600 Subject: [PATCH] Fix: Manila Alphabetize APT packages and Docs Changes staged this time --- .../workflows/container-build-manila-api.yaml | 166 ------- .../container-build-manila-data.yaml | 166 ------- .../container-build-manila-scheduler.yaml | 166 ------- .../container-build-manila-share.yaml | 166 ------- ContainerFiles/manila | 406 +++++++++++++----- ContainerFiles/manila-api | 128 ------ ContainerFiles/manila-data | 138 ------ ContainerFiles/manila-scheduler | 131 ------ ContainerFiles/manila-share | 145 ------- scripts/manila-api-cve-patching.sh | 28 -- scripts/manila-cve-patching.sh | 18 + scripts/manila-data-cve-patching.sh | 28 -- scripts/manila-scheduler-cve-patching.sh | 28 -- scripts/manila-share-cve-patching.sh | 28 -- 14 files changed, 317 insertions(+), 1425 deletions(-) delete mode 100644 .github/workflows/container-build-manila-api.yaml delete mode 100644 .github/workflows/container-build-manila-data.yaml delete mode 100644 .github/workflows/container-build-manila-scheduler.yaml delete mode 100644 .github/workflows/container-build-manila-share.yaml delete mode 100644 ContainerFiles/manila-api delete mode 100644 ContainerFiles/manila-data delete mode 100644 ContainerFiles/manila-scheduler delete mode 100644 ContainerFiles/manila-share delete mode 100644 scripts/manila-api-cve-patching.sh delete mode 100644 scripts/manila-data-cve-patching.sh delete mode 100644 scripts/manila-scheduler-cve-patching.sh delete mode 100644 scripts/manila-share-cve-patching.sh diff --git a/.github/workflows/container-build-manila-api.yaml b/.github/workflows/container-build-manila-api.yaml deleted file mode 100644 index 37d474c..0000000 --- a/.github/workflows/container-build-manila-api.yaml +++ /dev/null @@ -1,166 +0,0 @@ ---- -name: Create and publish a manila-api image - -permissions: - actions: read - contents: read - id-token: write - packages: write - pull-requests: write - security-events: write - -on: - pull_request: - paths: - - .github/workflows/container-build-manila-api.yaml - - ContainerFiles/manila-api - - scripts/manila-api-cve-patching.sh - schedule: - - cron: '0 0 * * 0' # Run Weekly at midnight UTC - workflow_dispatch: - inputs: - openstack-constraints: - description: 'Version of OpenStack Constraints to use' - required: true - default: "master" - type: choice - options: - - master - - unmaintained/2024.1 - - stable/2025.1 - project-version: - description: 'Version of OpenStack manila to build, defaults to openstack-constraints if unspecified' - required: false - type: string - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }}/manila-api - project_version: ${{ github.event.inputs.project-version }} - # NOTE(cloudnull): This is used to parse the workflow_dispatch inputs, sadly the inputs are not available in the - # workflow_dispatch event, so they're being stored in the environment variables. This is a - # workaround until there's a better way to handle this. - openstack_constraints: > - ["unmaintained/2024.1", "stable/2025.1"] - -jobs: - init: - runs-on: ubuntu-latest - outputs: - openstack-constraints: ${{ steps.generate-matrix.outputs.openstack_constraints }} - steps: - - name: generate-matrix - id: generate-matrix - run: | - if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then - openstack_constraints="$(echo '${{ github.event.inputs.openstack-constraints }}' | jq -R '[select(length>0)]' | jq -c '.')" - fi - echo "openstack_constraints=${openstack_constraints:-${{ env.openstack_constraints }}}" >> $GITHUB_OUTPUT - build-and-push-image: - needs: - - init - strategy: - matrix: - openstack-constraints: ${{ fromJSON(needs.init.outputs.openstack-constraints)}} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Dynamically set MY_DATE environment variable - run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV - - name: Dynamically set OS_VERSION_PARSE environment variable - run: | - VERSION=$(echo -n "${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}" | awk -F'/' '{($2=="" ? x=$1 : x=$2); print x}') - echo "OS_VERSION_PARSE=${VERSION}" >> $GITHUB_ENV - NAME=$(echo -n "${{ env.IMAGE_NAME }}" | awk -F'/' '{print $NF}') - echo "CATEGORY_NAME=${VERSION}-${NAME}" >> $GITHUB_ENV - - name: Log in to the Container registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - name: Extract metadata (tags, labels) for Docker - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - file: ContainerFiles/manila-api - push: false - load: true - cache-from: type=gha - cache-to: type=gha,mode=max - tags: | - ${{ env.IMAGE_NAME }}:local - labels: ${{ steps.meta.outputs.labels }} - build-args: | - OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }} - OS_CONSTRAINTS=${{ matrix.openstack-constraints }} - CACHEBUST=${{ github.sha }} - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner - if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - with: - image-ref: '${{ env.IMAGE_NAME }}:local' - format: 'sarif' - output: 'trivy-results.sarif' - ignore-unfixed: true - skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip - severity: 'CRITICAL,HIGH,MEDIUM' - - name: Upload Trivy scan results to GitHub Security tab - continue-on-error: true - if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: 'trivy-results.sarif' - category: "${{ env.CATEGORY_NAME }}" - - name: Run Trivy scanner - uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner - if: ${{ github.event_name == 'pull_request' }} - with: - image-ref: '${{ env.IMAGE_NAME }}:local' - output: trivy.txt - ignore-unfixed: true - skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip - severity: 'CRITICAL,HIGH,MEDIUM' - - name: Create trivy output file in markdown format - if: ${{ github.event_name == 'pull_request' }} - run: | - if [[ -s trivy.txt ]]; then - echo "### Security Output" > trivy-output.txt - echo '```terraform' >> trivy-output.txt - cat trivy.txt >> trivy-output.txt - echo '```' >> trivy-output.txt - fi - - name: Publish Trivy Output to Summary - if: ${{ github.event_name == 'pull_request' }} - run: | - if [[ -s trivy-output.txt ]]; then - { - cat trivy-output.txt - } >> $GITHUB_STEP_SUMMARY - fi - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - file: ContainerFiles/manila-api - push: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - cache-from: type=gha - cache-to: type=gha,mode=max - tags: | - ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-latest - ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-${{ env.MY_DATE }} - labels: ${{ steps.meta.outputs.labels }} - build-args: | - OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }} - OS_CONSTRAINTS=${{ matrix.openstack-constraints }} - CACHEBUST=${{ github.sha }} diff --git a/.github/workflows/container-build-manila-data.yaml b/.github/workflows/container-build-manila-data.yaml deleted file mode 100644 index 3a04733..0000000 --- a/.github/workflows/container-build-manila-data.yaml +++ /dev/null @@ -1,166 +0,0 @@ ---- -name: Create and publish a manila-data image - -permissions: - actions: read - contents: read - id-token: write - packages: write - pull-requests: write - security-events: write - -on: - pull_request: - paths: - - .github/workflows/container-build-manila-data.yaml - - ContainerFiles/manila-data - - scripts/manila-data-cve-patching.sh - schedule: - - cron: '0 0 * * 0' # Run Weekly at midnight UTC - workflow_dispatch: - inputs: - openstack-constraints: - description: 'Version of OpenStack Constraints to use' - required: true - default: "master" - type: choice - options: - - master - - unmaintained/2024.1 - - stable/2025.1 - project-version: - description: 'Version of OpenStack manila to build, defaults to openstack-constraints if unspecified' - required: false - type: string - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }}/manila-data - project_version: ${{ github.event.inputs.project-version }} - # NOTE(cloudnull): This is used to parse the workflow_dispatch inputs, sadly the inputs are not available in the - # workflow_dispatch event, so they're being stored in the environment variables. This is a - # workaround until there's a better way to handle this. - openstack_constraints: > - ["unmaintained/2024.1", "stable/2025.1"] - -jobs: - init: - runs-on: ubuntu-latest - outputs: - openstack-constraints: ${{ steps.generate-matrix.outputs.openstack_constraints }} - steps: - - name: generate-matrix - id: generate-matrix - run: | - if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then - openstack_constraints="$(echo '${{ github.event.inputs.openstack-constraints }}' | jq -R '[select(length>0)]' | jq -c '.')" - fi - echo "openstack_constraints=${openstack_constraints:-${{ env.openstack_constraints }}}" >> $GITHUB_OUTPUT - build-and-push-image: - needs: - - init - strategy: - matrix: - openstack-constraints: ${{ fromJSON(needs.init.outputs.openstack-constraints)}} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Dynamically set MY_DATE environment variable - run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV - - name: Dynamically set OS_VERSION_PARSE environment variable - run: | - VERSION=$(echo -n "${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}" | awk -F'/' '{($2=="" ? x=$1 : x=$2); print x}') - echo "OS_VERSION_PARSE=${VERSION}" >> $GITHUB_ENV - NAME=$(echo -n "${{ env.IMAGE_NAME }}" | awk -F'/' '{print $NF}') - echo "CATEGORY_NAME=${VERSION}-${NAME}" >> $GITHUB_ENV - - name: Log in to the Container registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - name: Extract metadata (tags, labels) for Docker - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - file: ContainerFiles/manila-data - push: false - load: true - cache-from: type=gha - cache-to: type=gha,mode=max - tags: | - ${{ env.IMAGE_NAME }}:local - labels: ${{ steps.meta.outputs.labels }} - build-args: | - OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }} - OS_CONSTRAINTS=${{ matrix.openstack-constraints }} - CACHEBUST=${{ github.sha }} - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner - if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - with: - image-ref: '${{ env.IMAGE_NAME }}:local' - format: 'sarif' - output: 'trivy-results.sarif' - ignore-unfixed: true - skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip - severity: 'CRITICAL,HIGH,MEDIUM' - - name: Upload Trivy scan results to GitHub Security tab - continue-on-error: true - if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: 'trivy-results.sarif' - category: "${{ env.CATEGORY_NAME }}" - - name: Run Trivy scanner - uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner - if: ${{ github.event_name == 'pull_request' }} - with: - image-ref: '${{ env.IMAGE_NAME }}:local' - output: trivy.txt - ignore-unfixed: true - skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip - severity: 'CRITICAL,HIGH,MEDIUM' - - name: Create trivy output file in markdown format - if: ${{ github.event_name == 'pull_request' }} - run: | - if [[ -s trivy.txt ]]; then - echo "### Security Output" > trivy-output.txt - echo '```terraform' >> trivy-output.txt - cat trivy.txt >> trivy-output.txt - echo '```' >> trivy-output.txt - fi - - name: Publish Trivy Output to Summary - if: ${{ github.event_name == 'pull_request' }} - run: | - if [[ -s trivy-output.txt ]]; then - { - cat trivy-output.txt - } >> $GITHUB_STEP_SUMMARY - fi - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - file: ContainerFiles/manila-data - push: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - cache-from: type=gha - cache-to: type=gha,mode=max - tags: | - ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-latest - ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-${{ env.MY_DATE }} - labels: ${{ steps.meta.outputs.labels }} - build-args: | - OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }} - OS_CONSTRAINTS=${{ matrix.openstack-constraints }} - CACHEBUST=${{ github.sha }} diff --git a/.github/workflows/container-build-manila-scheduler.yaml b/.github/workflows/container-build-manila-scheduler.yaml deleted file mode 100644 index 99a0a20..0000000 --- a/.github/workflows/container-build-manila-scheduler.yaml +++ /dev/null @@ -1,166 +0,0 @@ ---- -name: Create and publish a manila-scheduler image - -permissions: - actions: read - contents: read - id-token: write - packages: write - pull-requests: write - security-events: write - -on: - pull_request: - paths: - - .github/workflows/container-build-manila-scheduler.yaml - - ContainerFiles/manila-scheduler - - scripts/manila-scheduler-cve-patching.sh - schedule: - - cron: '0 0 * * 0' # Run Weekly at midnight UTC - workflow_dispatch: - inputs: - openstack-constraints: - description: 'Version of OpenStack Constraints to use' - required: true - default: "master" - type: choice - options: - - master - - unmaintained/2024.1 - - stable/2025.1 - project-version: - description: 'Version of OpenStack manila to build, defaults to openstack-constraints if unspecified' - required: false - type: string - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }}/manila-scheduler - project_version: ${{ github.event.inputs.project-version }} - # NOTE(cloudnull): This is used to parse the workflow_dispatch inputs, sadly the inputs are not available in the - # workflow_dispatch event, so they're being stored in the environment variables. This is a - # workaround until there's a better way to handle this. - openstack_constraints: > - ["unmaintained/2024.1", "stable/2025.1"] - -jobs: - init: - runs-on: ubuntu-latest - outputs: - openstack-constraints: ${{ steps.generate-matrix.outputs.openstack_constraints }} - steps: - - name: generate-matrix - id: generate-matrix - run: | - if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then - openstack_constraints="$(echo '${{ github.event.inputs.openstack-constraints }}' | jq -R '[select(length>0)]' | jq -c '.')" - fi - echo "openstack_constraints=${openstack_constraints:-${{ env.openstack_constraints }}}" >> $GITHUB_OUTPUT - build-and-push-image: - needs: - - init - strategy: - matrix: - openstack-constraints: ${{ fromJSON(needs.init.outputs.openstack-constraints)}} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Dynamically set MY_DATE environment variable - run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV - - name: Dynamically set OS_VERSION_PARSE environment variable - run: | - VERSION=$(echo -n "${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}" | awk -F'/' '{($2=="" ? x=$1 : x=$2); print x}') - echo "OS_VERSION_PARSE=${VERSION}" >> $GITHUB_ENV - NAME=$(echo -n "${{ env.IMAGE_NAME }}" | awk -F'/' '{print $NF}') - echo "CATEGORY_NAME=${VERSION}-${NAME}" >> $GITHUB_ENV - - name: Log in to the Container registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - name: Extract metadata (tags, labels) for Docker - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - file: ContainerFiles/manila-scheduler - push: false - load: true - cache-from: type=gha - cache-to: type=gha,mode=max - tags: | - ${{ env.IMAGE_NAME }}:local - labels: ${{ steps.meta.outputs.labels }} - build-args: | - OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }} - OS_CONSTRAINTS=${{ matrix.openstack-constraints }} - CACHEBUST=${{ github.sha }} - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner - if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - with: - image-ref: '${{ env.IMAGE_NAME }}:local' - format: 'sarif' - output: 'trivy-results.sarif' - ignore-unfixed: true - skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip - severity: 'CRITICAL,HIGH,MEDIUM' - - name: Upload Trivy scan results to GitHub Security tab - continue-on-error: true - if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: 'trivy-results.sarif' - category: "${{ env.CATEGORY_NAME }}" - - name: Run Trivy scanner - uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner - if: ${{ github.event_name == 'pull_request' }} - with: - image-ref: '${{ env.IMAGE_NAME }}:local' - output: trivy.txt - ignore-unfixed: true - skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip - severity: 'CRITICAL,HIGH,MEDIUM' - - name: Create trivy output file in markdown format - if: ${{ github.event_name == 'pull_request' }} - run: | - if [[ -s trivy.txt ]]; then - echo "### Security Output" > trivy-output.txt - echo '```terraform' >> trivy-output.txt - cat trivy.txt >> trivy-output.txt - echo '```' >> trivy-output.txt - fi - - name: Publish Trivy Output to Summary - if: ${{ github.event_name == 'pull_request' }} - run: | - if [[ -s trivy-output.txt ]]; then - { - cat trivy-output.txt - } >> $GITHUB_STEP_SUMMARY - fi - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - file: ContainerFiles/manila-scheduler - push: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - cache-from: type=gha - cache-to: type=gha,mode=max - tags: | - ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-latest - ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-${{ env.MY_DATE }} - labels: ${{ steps.meta.outputs.labels }} - build-args: | - OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }} - OS_CONSTRAINTS=${{ matrix.openstack-constraints }} - CACHEBUST=${{ github.sha }} diff --git a/.github/workflows/container-build-manila-share.yaml b/.github/workflows/container-build-manila-share.yaml deleted file mode 100644 index 2bcf09f..0000000 --- a/.github/workflows/container-build-manila-share.yaml +++ /dev/null @@ -1,166 +0,0 @@ ---- -name: Create and publish a manila-share image - -permissions: - actions: read - contents: read - id-token: write - packages: write - pull-requests: write - security-events: write - -on: - pull_request: - paths: - - .github/workflows/container-build-manila-share.yaml - - ContainerFiles/manila-share - - scripts/manila-share-cve-patching.sh - schedule: - - cron: '0 0 * * 0' # Run Weekly at midnight UTC - workflow_dispatch: - inputs: - openstack-constraints: - description: 'Version of OpenStack Constraints to use' - required: true - default: "master" - type: choice - options: - - master - - unmaintained/2024.1 - - stable/2025.1 - project-version: - description: 'Version of OpenStack manila to build, defaults to openstack-constraints if unspecified' - required: false - type: string - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }}/manila-share - project_version: ${{ github.event.inputs.project-version }} - # NOTE(cloudnull): This is used to parse the workflow_dispatch inputs, sadly the inputs are not available in the - # workflow_dispatch event, so they're being stored in the environment variables. This is a - # workaround until there's a better way to handle this. - openstack_constraints: > - ["unmaintained/2024.1", "stable/2025.1"] - -jobs: - init: - runs-on: ubuntu-latest - outputs: - openstack-constraints: ${{ steps.generate-matrix.outputs.openstack_constraints }} - steps: - - name: generate-matrix - id: generate-matrix - run: | - if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then - openstack_constraints="$(echo '${{ github.event.inputs.openstack-constraints }}' | jq -R '[select(length>0)]' | jq -c '.')" - fi - echo "openstack_constraints=${openstack_constraints:-${{ env.openstack_constraints }}}" >> $GITHUB_OUTPUT - build-and-push-image: - needs: - - init - strategy: - matrix: - openstack-constraints: ${{ fromJSON(needs.init.outputs.openstack-constraints)}} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Dynamically set MY_DATE environment variable - run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV - - name: Dynamically set OS_VERSION_PARSE environment variable - run: | - VERSION=$(echo -n "${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}" | awk -F'/' '{($2=="" ? x=$1 : x=$2); print x}') - echo "OS_VERSION_PARSE=${VERSION}" >> $GITHUB_ENV - NAME=$(echo -n "${{ env.IMAGE_NAME }}" | awk -F'/' '{print $NF}') - echo "CATEGORY_NAME=${VERSION}-${NAME}" >> $GITHUB_ENV - - name: Log in to the Container registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - name: Extract metadata (tags, labels) for Docker - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - file: ContainerFiles/manila-share - push: false - load: true - cache-from: type=gha - cache-to: type=gha,mode=max - tags: | - ${{ env.IMAGE_NAME }}:local - labels: ${{ steps.meta.outputs.labels }} - build-args: | - OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }} - OS_CONSTRAINTS=${{ matrix.openstack-constraints }} - CACHEBUST=${{ github.sha }} - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner - if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - with: - image-ref: '${{ env.IMAGE_NAME }}:local' - format: 'sarif' - output: 'trivy-results.sarif' - ignore-unfixed: true - skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip - severity: 'CRITICAL,HIGH,MEDIUM' - - name: Upload Trivy scan results to GitHub Security tab - continue-on-error: true - if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: 'trivy-results.sarif' - category: "${{ env.CATEGORY_NAME }}" - - name: Run Trivy scanner - uses: aquasecurity/trivy-action@0.33.1 # using latest trivy scanner - if: ${{ github.event_name == 'pull_request' }} - with: - image-ref: '${{ env.IMAGE_NAME }}:local' - output: trivy.txt - ignore-unfixed: true - skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip - severity: 'CRITICAL,HIGH,MEDIUM' - - name: Create trivy output file in markdown format - if: ${{ github.event_name == 'pull_request' }} - run: | - if [[ -s trivy.txt ]]; then - echo "### Security Output" > trivy-output.txt - echo '```terraform' >> trivy-output.txt - cat trivy.txt >> trivy-output.txt - echo '```' >> trivy-output.txt - fi - - name: Publish Trivy Output to Summary - if: ${{ github.event_name == 'pull_request' }} - run: | - if [[ -s trivy-output.txt ]]; then - { - cat trivy-output.txt - } >> $GITHUB_STEP_SUMMARY - fi - - name: Build and push Docker image - uses: docker/build-push-action@v6 - with: - context: . - file: ContainerFiles/manila-share - push: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} - cache-from: type=gha - cache-to: type=gha,mode=max - tags: | - ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-latest - ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-${{ env.MY_DATE }} - labels: ${{ steps.meta.outputs.labels }} - build-args: | - OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }} - OS_CONSTRAINTS=${{ matrix.openstack-constraints }} - CACHEBUST=${{ github.sha }} diff --git a/ContainerFiles/manila b/ContainerFiles/manila index 222b3a7..40d803e 100644 --- a/ContainerFiles/manila +++ b/ContainerFiles/manila @@ -1,133 +1,325 @@ -# syntax = docker/dockerfile:1 +# syntax = docker/dockerfile:1.4.0 +# DOCKER # This Dockerfile uses multi-stage build to customize DEV and PROD images: # https://docs.docker.com/develop/develop-images/multistage-build/ ARG VENV_TAG=3.12-latest FROM ghcr.io/rackerlabs/genestack-images/openstack-venv:${VENV_TAG} AS dependency_build + ARG CACHEBUST=0 ARG OS_VERSION=master ARG OS_CONSTRAINTS=master -RUN export DEBIAN_FRONTEND=noninteractive \ - && apt-get update && apt-get upgrade -y \ - && apt-get install --no-install-recommends -y \ - bash \ - brotli \ - build-essential \ - cargo \ - curl \ - docutils-common \ - gettext \ - git \ - libffi-dev \ - libjs-sphinxdoc \ - libjs-underscore \ - libldap2-dev \ - libpq-dev \ - libsasl2-dev \ - libssl-dev \ - libsystemd-dev \ - libxml2-dev \ - libxslt1-dev \ - libxslt1.1 \ - default-mysql-client \ - default-mysql-server \ - postgresql-client \ - pkg-config \ - python3-dev \ - ssl-cert \ - xmlsec1 -RUN /usr/local/bin/python -m pip install --upgrade --force-reinstall pip -RUN /var/lib/openstack/bin/pip install --constraint https://opendev.org/openstack/requirements/raw/branch/${OS_CONSTRAINTS}/upper-constraints.txt \ - git+https://opendev.org/openstack/manila.git@${OS_VERSION}#egg=manila \ - PyMySQL \ - python-memcached \ - uwsgi -RUN /var/lib/openstack/bin/python -m pip install --upgrade --force-reinstall pip pyOpenSSL==25.3.0 +ARG DEBIAN_FRONTEND=noninteractive + +RUN <