Skip to content

Commit 9f44b9e

Browse files
nvuillamnvuillam
committed
Authenticate to GitHub API during docker build to avoid reaching limits
1 parent 7ec38ab commit 9f44b9e

File tree

45 files changed

+89
-69
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+89
-69
lines changed

‎.automation/build.py

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -306,15 +306,26 @@ def build_dockerfile(
306306
docker_copy += [dockerfile_item]
307307
docker_other += ["# Managed with " + dockerfile_item]
308308
# Already used item
309-
elif dockerfile_item in all_dockerfile_items:
309+
elif (
310+
dockerfile_item in all_dockerfile_items
311+
or dockerfile_item.replace(
312+
"RUN ", "RUN --mount=type=secret,id=GITHUB_TOKEN "
313+
)
314+
in all_dockerfile_items
315+
):
310316
dockerfile_item = (
311317
"# Next line commented because already managed by another linter\n"
312318
"# " + "\n# ".join(dockerfile_item.splitlines())
313319
)
314320
docker_other += [dockerfile_item]
315321
# RUN (standalone with GITHUB_TOKEN)
316-
elif dockerfile_item.startswith("RUN") and "GITHUB_TOKEN" in dockerfile_item:
317-
dockerfile_item_cmd = dockerfile_item.replace("RUN ", "RUN --mount=type=secret,id=GITHUB_TOKEN ")
322+
elif (
323+
dockerfile_item.startswith("RUN")
324+
and "GITHUB_TOKEN" in dockerfile_item
325+
):
326+
dockerfile_item_cmd = dockerfile_item.replace(
327+
"RUN ", "RUN --mount=type=secret,id=GITHUB_TOKEN "
328+
)
318329
docker_other += [dockerfile_item_cmd]
319330
is_docker_other_run = False
320331
# RUN (start)

‎CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,10 @@ Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-l
1010

1111
- Core
1212
- Upgrade base docker image from python:3.10.4-alpine3.16 to python:3.11.1-alpine3.17
13+
14+
- CI
1315
- Use docker/build-push-action to build docker images and akhilerm/tag-push-action to release by retagging and pushing beta images instead of rebuilding them
16+
- Authenticate to GitHub API during docker build to avoid reaching limits
1417

1518
- Linter versions upgrades
1619
- [golangci-lint](https://golangci-lint.run/) from 1.51.0 to **1.51.1** on 2023-02-06

‎Dockerfile

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -299,9 +299,9 @@ COPY --from=kics /app/bin/assets /opt/kics/assets/
299299
## @generated by .automation/build.py using descriptor files, please do not update manually ##
300300
#############################################################################################
301301
#OTHER__START
302-
RUN rc-update add docker boot && rc-service docker start || true \
302+
RUN rc-update add docker boot && rc-service docker start || true
303303
# ARM installation
304-
&& mkdir -p ${PWSH_DIRECTORY} \
304+
RUN --mount=type=secret,id=GITHUB_TOKEN mkdir -p ${PWSH_DIRECTORY} \
305305
&& curl --retry 5 --retry-delay 5 -s \
306306
-H "Accept: application/vnd.github+json" \
307307
-H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
@@ -311,10 +311,11 @@ RUN rc-update add docker boot && rc-service docker start || true \
311311
| cut -d '"' -f 4 \
312312
| xargs -n 1 wget -O - \
313313
| tar -xzC ${PWSH_DIRECTORY} \
314-
&& ln -sf ${PWSH_DIRECTORY}/pwsh /usr/bin/pwsh \
314+
&& ln -sf ${PWSH_DIRECTORY}/pwsh /usr/bin/pwsh
315+
315316

316317
# CSHARP installation
317-
&& wget --tries=5 -q -O dotnet-install.sh https://dot.net/v1/dotnet-install.sh \
318+
RUN wget --tries=5 -q -O dotnet-install.sh https://dot.net/v1/dotnet-install.sh \
318319
&& chmod +x dotnet-install.sh \
319320
&& ./dotnet-install.sh --install-dir /usr/share/dotnet -channel 6.0 -version latest
320321

@@ -341,7 +342,7 @@ RUN wget --tries=5 -q -O phive.phar https://phar.io/releases/phive.phar \
341342
ENV PATH="/root/.composer/vendor/bin:$PATH"
342343

343344
# POWERSHELL installation
344-
RUN mkdir -p ${PWSH_DIRECTORY} \
345+
RUN --mount=type=secret,id=GITHUB_TOKEN mkdir -p ${PWSH_DIRECTORY} \
345346
&& curl --retry 5 --retry-delay 5 -s \
346347
-H "Accept: application/vnd.github+json" \
347348
-H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
@@ -352,14 +353,15 @@ RUN mkdir -p ${PWSH_DIRECTORY} \
352353
| xargs -n 1 wget -O - \
353354
| tar -xzC ${PWSH_DIRECTORY} \
354355
&& ln -sf ${PWSH_DIRECTORY}/pwsh /usr/bin/pwsh \
355-
&& chmod +x /usr/bin/pwsh \
356+
&& chmod +x /usr/bin/pwsh
357+
356358

357359
# SALESFORCE installation
358360
# Next line commented because already managed by another linter
359361
# ENV JAVA_HOME=/usr/lib/jvm/java-11-openjdk
360362
# Next line commented because already managed by another linter
361363
# ENV PATH="$JAVA_HOME/bin:${PATH}"
362-
&& echo y|sfdx plugins:install sfdx-hardis \
364+
RUN echo y|sfdx plugins:install sfdx-hardis \
363365
&& npm cache clean --force || true \
364366
&& rm -rf /root/.npm/_cacache \
365367

@@ -436,21 +438,22 @@ RUN curl --retry 5 --retry-delay 5 -sLO "${ARM_TTK_URI}" \
436438
&& golangci-lint --version \
437439

438440
# revive installation
439-
&& go install github.com/mgechev/revive@latest && go clean --cache \
441+
&& go install github.com/mgechev/revive@latest && go clean --cache
440442

441443
# checkstyle installation
442-
&& CHECKSTYLE_LATEST=$(curl -s \
444+
RUN --mount=type=secret,id=GITHUB_TOKEN CHECKSTYLE_LATEST=$(curl -s \
443445
-H "Accept: application/vnd.github+json" \
444446
-H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
445447
https://api.github.com/repos/checkstyle/checkstyle/releases/latest \
446448
| grep browser_download_url \
447449
| grep ".jar" \
448450
| cut -d '"' -f 4) \
449451
&& curl --retry 5 --retry-delay 5 -sSL $CHECKSTYLE_LATEST \
450-
--output /usr/bin/checkstyle \
452+
--output /usr/bin/checkstyle
453+
451454

452455
# pmd installation
453-
&& wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-bin-${PMD_VERSION}.zip && \
456+
RUN wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-bin-${PMD_VERSION}.zip && \
454457
unzip pmd-bin-${PMD_VERSION}.zip && \
455458
rm pmd-bin-${PMD_VERSION}.zip && \
456459
mv pmd-bin-${PMD_VERSION} /usr/bin/pmd && \

‎flavors/ci_light/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ FROM zricethezav/gitleaks:v8.15.3 as gitleaks
1919
##################
2020
# Get base image #
2121
##################
22-
# 3.10.5 is not usable until https://github.com/jruere/multiprocessing-logging/issues/56 is fixed
2322
FROM python:3.11.1-alpine3.17
23+
ARG GITHUB_TOKEN
2424

2525
#############################################################################################
2626
## @generated by .automation/build.py using descriptor files, please do not update manually ##

‎flavors/cupcake/Dockerfile

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@ FROM checkmarx/kics:alpine as kics
2525
##################
2626
# Get base image #
2727
##################
28-
# 3.10.5 is not usable until https://github.com/jruere/multiprocessing-logging/issues/56 is fixed
2928
FROM python:3.11.1-alpine3.17
29+
ARG GITHUB_TOKEN
3030

3131
#############################################################################################
3232
## @generated by .automation/build.py using descriptor files, please do not update manually ##
@@ -315,21 +315,22 @@ RUN go install github.com/rhysd/actionlint/cmd/actionlint@latest && go clean --c
315315
&& golangci-lint --version \
316316

317317
# revive installation
318-
&& go install github.com/mgechev/revive@latest && go clean --cache \
318+
&& go install github.com/mgechev/revive@latest && go clean --cache
319319

320320
# checkstyle installation
321-
&& CHECKSTYLE_LATEST=$(curl -s \
321+
RUN --mount=type=secret,id=GITHUB_TOKEN CHECKSTYLE_LATEST=$(curl -s \
322322
-H "Accept: application/vnd.github+json" \
323323
-H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
324324
https://api.github.com/repos/checkstyle/checkstyle/releases/latest \
325325
| grep browser_download_url \
326326
| grep ".jar" \
327327
| cut -d '"' -f 4) \
328328
&& curl --retry 5 --retry-delay 5 -sSL $CHECKSTYLE_LATEST \
329-
--output /usr/bin/checkstyle \
329+
--output /usr/bin/checkstyle
330+
330331

331332
# pmd installation
332-
&& wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-bin-${PMD_VERSION}.zip && \
333+
RUN wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-bin-${PMD_VERSION}.zip && \
333334
unzip pmd-bin-${PMD_VERSION}.zip && \
334335
rm pmd-bin-${PMD_VERSION}.zip && \
335336
mv pmd-bin-${PMD_VERSION} /usr/bin/pmd && \

‎flavors/documentation/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ FROM zricethezav/gitleaks:v8.15.3 as gitleaks
2121
##################
2222
# Get base image #
2323
##################
24-
# 3.10.5 is not usable until https://github.com/jruere/multiprocessing-logging/issues/56 is fixed
2524
FROM python:3.11.1-alpine3.17
25+
ARG GITHUB_TOKEN
2626

2727
#############################################################################################
2828
## @generated by .automation/build.py using descriptor files, please do not update manually ##

‎flavors/dotnet/Dockerfile

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ FROM zricethezav/gitleaks:v8.15.3 as gitleaks
2121
##################
2222
# Get base image #
2323
##################
24-
# 3.10.5 is not usable until https://github.com/jruere/multiprocessing-logging/issues/56 is fixed
2524
FROM python:3.11.1-alpine3.17
25+
ARG GITHUB_TOKEN
2626

2727
#############################################################################################
2828
## @generated by .automation/build.py using descriptor files, please do not update manually ##
@@ -223,7 +223,7 @@ COPY --from=gitleaks /usr/bin/gitleaks /usr/bin/
223223
#############################################################################################
224224
#OTHER__START
225225
# ARM installation
226-
RUN mkdir -p ${PWSH_DIRECTORY} \
226+
RUN --mount=type=secret,id=GITHUB_TOKEN mkdir -p ${PWSH_DIRECTORY} \
227227
&& curl --retry 5 --retry-delay 5 -s \
228228
-H "Accept: application/vnd.github+json" \
229229
-H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
@@ -233,17 +233,18 @@ RUN mkdir -p ${PWSH_DIRECTORY} \
233233
| cut -d '"' -f 4 \
234234
| xargs -n 1 wget -O - \
235235
| tar -xzC ${PWSH_DIRECTORY} \
236-
&& ln -sf ${PWSH_DIRECTORY}/pwsh /usr/bin/pwsh \
236+
&& ln -sf ${PWSH_DIRECTORY}/pwsh /usr/bin/pwsh
237+
237238

238239
# CSHARP installation
239-
&& wget --tries=5 -q -O dotnet-install.sh https://dot.net/v1/dotnet-install.sh \
240+
RUN wget --tries=5 -q -O dotnet-install.sh https://dot.net/v1/dotnet-install.sh \
240241
&& chmod +x dotnet-install.sh \
241242
&& ./dotnet-install.sh --install-dir /usr/share/dotnet -channel 6.0 -version latest
242243

243244
ENV PATH="${PATH}:/root/.dotnet/tools:/usr/share/dotnet"
244245

245246
# POWERSHELL installation
246-
RUN mkdir -p ${PWSH_DIRECTORY} \
247+
RUN --mount=type=secret,id=GITHUB_TOKEN mkdir -p ${PWSH_DIRECTORY} \
247248
&& curl --retry 5 --retry-delay 5 -s \
248249
-H "Accept: application/vnd.github+json" \
249250
-H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \

‎flavors/go/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ FROM zricethezav/gitleaks:v8.15.3 as gitleaks
2121
##################
2222
# Get base image #
2323
##################
24-
# 3.10.5 is not usable until https://github.com/jruere/multiprocessing-logging/issues/56 is fixed
2524
FROM python:3.11.1-alpine3.17
25+
ARG GITHUB_TOKEN
2626

2727
#############################################################################################
2828
## @generated by .automation/build.py using descriptor files, please do not update manually ##

‎flavors/java/Dockerfile

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ FROM zricethezav/gitleaks:v8.15.3 as gitleaks
2222
##################
2323
# Get base image #
2424
##################
25-
# 3.10.5 is not usable until https://github.com/jruere/multiprocessing-logging/issues/56 is fixed
2625
FROM python:3.11.1-alpine3.17
26+
ARG GITHUB_TOKEN
2727

2828
#############################################################################################
2929
## @generated by .automation/build.py using descriptor files, please do not update manually ##
@@ -236,21 +236,22 @@ RUN go install github.com/rhysd/actionlint/cmd/actionlint@latest && go clean --c
236236
# Managed with COPY --from=editorconfig-checker /usr/bin/ec /usr/bin/editorconfig-checker
237237

238238
# dotenv-linter installation
239-
&& wget -q -O - https://raw.githubusercontent.com/dotenv-linter/dotenv-linter/master/install.sh | sh -s \
239+
&& wget -q -O - https://raw.githubusercontent.com/dotenv-linter/dotenv-linter/master/install.sh | sh -s
240240

241241
# checkstyle installation
242-
&& CHECKSTYLE_LATEST=$(curl -s \
242+
RUN --mount=type=secret,id=GITHUB_TOKEN CHECKSTYLE_LATEST=$(curl -s \
243243
-H "Accept: application/vnd.github+json" \
244244
-H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
245245
https://api.github.com/repos/checkstyle/checkstyle/releases/latest \
246246
| grep browser_download_url \
247247
| grep ".jar" \
248248
| cut -d '"' -f 4) \
249249
&& curl --retry 5 --retry-delay 5 -sSL $CHECKSTYLE_LATEST \
250-
--output /usr/bin/checkstyle \
250+
--output /usr/bin/checkstyle
251+
251252

252253
# pmd installation
253-
&& wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-bin-${PMD_VERSION}.zip && \
254+
RUN wget --quiet https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-bin-${PMD_VERSION}.zip && \
254255
unzip pmd-bin-${PMD_VERSION}.zip && \
255256
rm pmd-bin-${PMD_VERSION}.zip && \
256257
mv pmd-bin-${PMD_VERSION} /usr/bin/pmd && \

‎flavors/javascript/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ FROM zricethezav/gitleaks:v8.15.3 as gitleaks
2121
##################
2222
# Get base image #
2323
##################
24-
# 3.10.5 is not usable until https://github.com/jruere/multiprocessing-logging/issues/56 is fixed
2524
FROM python:3.11.1-alpine3.17
25+
ARG GITHUB_TOKEN
2626

2727
#############################################################################################
2828
## @generated by .automation/build.py using descriptor files, please do not update manually ##

0 commit comments

Comments
 (0)