public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v9.4.x] Security Scans: Add trivy scans to every docker image used for building/testing/publishing (#69911) (#69920)

Browse Source 
* Security Scans: Add trivy scans to every docker image used for building/testing/publishing (#69911)

* Created images.star

* Fix typo

* Add cronjobs for build-images

(cherry picked from commit 2cda971796)

# Conflicts:
#	.drone.yml
#	scripts/drone/services/services.star
#	scripts/drone/steps/lib.star

* Fix rebasing issue
This commit is contained in:
Dimitris Sotirakis
2023-06-12 17:32:09 +03:00
committed by GitHub
parent 12c6626a42
commit 0850edc137
12 changed files with 284 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/drone/steps/lib.star
+65 -71
View File
@@ -7,18 +7,12 @@ load(
"from_secret",
"prerelease_bucket",
)
load(
"scripts/drone/utils/images.star",
"images",
)
grabpl_version = "v3.0.38"
cloudsdk_image = "google/cloud-sdk:431.0.0"
build_image = "grafana/build-container:1.7.4"
publish_image = "grafana/grafana-ci-deploy:1.3.3"
deploy_docker_image = "us.gcr.io/kubernetes-dev/drone/plugins/deploy-image"
alpine_image = "alpine:3.17.1"
curl_image = "byrnedo/alpine-curl:0.1.8"
windows_image = "mcr.microsoft.com/windows:1809"
wix_image = "grafana/ci-wix:0.1.1"
go_image = "golang:1.20.4"
windows_go_image = "grafana/grafana-ci-windows-test:0.1.0"
trigger_oss = {
"repo": [
@@ -29,7 +23,7 @@ trigger_oss = {
def slack_step(channel, template, secret):
return {
"name": "slack",
"image": "plugins/slack",
"image": images["plugins_slack_image"],
"settings": {
"webhook": from_secret(secret),
"channel": channel,
@@ -40,7 +34,7 @@ def slack_step(channel, template, secret):
def yarn_install_step():
return {
"name": "yarn-install",
"image": build_image,
"image": images["build_image"],
"commands": [
"yarn install --immutable",
],
@@ -50,7 +44,7 @@ def yarn_install_step():
def wire_install_step():
return {
"name": "wire-install",
"image": build_image,
"image": images["build_image"],
"commands": [
"make gen-go",
],
@@ -62,7 +56,7 @@ def wire_install_step():
def windows_wire_install_step(edition):
return {
"name": "wire-install",
"image": windows_go_image,
"image": images["windows_go_image"],
"commands": [
"go install github.com/google/wire/cmd/wire@v0.5.0",
"wire gen -tags {} ./pkg/server".format(edition),
@@ -76,7 +70,7 @@ def identify_runner_step(platform = "linux"):
if platform == "linux":
return {
"name": "identify-runner",
"image": alpine_image,
"image": images["alpine_image"],
"commands": [
"echo $DRONE_RUNNER_NAME",
],
@@ -84,7 +78,7 @@ def identify_runner_step(platform = "linux"):
else:
return {
"name": "identify-runner",
"image": windows_image,
"image": images["windows_image"],
"commands": [
"echo $env:DRONE_RUNNER_NAME",
],
@@ -101,7 +95,7 @@ def clone_enterprise_step(committish = "${DRONE_COMMIT}"):
"""
return {
"name": "clone-enterprise",
"image": build_image,
"image": images["build_image"],
"environment": {
"GITHUB_TOKEN": from_secret("github_token"),
},
@@ -140,7 +134,7 @@ def init_enterprise_step(ver_mode):
token = ""
return {
"name": "init-enterprise",
"image": build_image,
"image": images["build_image"],
"depends_on": [
"clone-enterprise",
"grabpl",
@@ -198,7 +192,7 @@ def windows_init_enterprise_steps(ver_mode):
download_grabpl_step(platform = "windows"),
{
"name": "clone",
"image": wix_image,
"image": images["wix_image"],
"environment": {
"GITHUB_TOKEN": from_secret("github_token"),
},
@@ -206,7 +200,7 @@ def windows_init_enterprise_steps(ver_mode):
},
{
"name": "windows-init",
"image": wix_image,
"image": images["wix_image"],
"commands": init_cmds,
"depends_on": ["clone"],
"environment": {"GITHUB_TOKEN": from_secret("github_token")},
@@ -219,7 +213,7 @@ def download_grabpl_step(platform = "linux"):
if platform == "windows":
return {
"name": "grabpl",
"image": wix_image,
"image": images["wix_image"],
"commands": [
'$$ProgressPreference = "SilentlyContinue"',
"Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/{}/windows/grabpl.exe -OutFile grabpl.exe".format(
@@ -230,7 +224,7 @@ def download_grabpl_step(platform = "linux"):
return {
"name": "grabpl",
"image": curl_image,
"image": images["curl_image"],
"commands": [
"mkdir -p bin",
"curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/{}/grabpl".format(
@@ -243,7 +237,7 @@ def download_grabpl_step(platform = "linux"):
def lint_drone_step():
return {
"name": "lint-drone",
"image": curl_image,
"image": images["curl_image"],
"commands": [
"./bin/build verify-drone",
],
@@ -255,7 +249,7 @@ def lint_drone_step():
def lint_starlark_step():
return {
"name": "lint-starlark",
"image": build_image,
"image": images["build_image"],
"commands": [
"./bin/build verify-starlark .",
],
@@ -282,7 +276,7 @@ def enterprise_downstream_step(ver_mode):
step = {
"name": "trigger-enterprise-downstream",
"image": "grafana/drone-downstream",
"image": images["drone_downstream_image"],
"settings": {
"server": "https://drone.grafana.net",
"token": from_secret("drone_token"),
@@ -306,7 +300,7 @@ def lint_backend_step():
return {
"name": "lint-backend",
# TODO: build_image or go_image?
"image": go_image,
"image": images["go_image"],
"environment": {
# We need CGO because of go-sqlite3
"CGO_ENABLED": "1",
@@ -324,7 +318,7 @@ def lint_backend_step():
def benchmark_ldap_step():
return {
"name": "benchmark-ldap",
"image": build_image,
"image": images["build_image"],
"environment": {
"LDAP_HOSTNAME": "ldap",
},
@@ -337,7 +331,7 @@ def benchmark_ldap_step():
def build_storybook_step(ver_mode):
return {
"name": "build-storybook",
"image": build_image,
"image": images["build_image"],
"depends_on": [
# Best to ensure that this step doesn't mess with what's getting built and packaged
"build-frontend",
@@ -381,7 +375,7 @@ def store_storybook_step(ver_mode, trigger = None):
step = {
"name": "store-storybook",
"image": publish_image,
"image": images["publish_image"],
"depends_on": [
"build-storybook",
] +
@@ -411,7 +405,7 @@ def store_storybook_step(ver_mode, trigger = None):
def e2e_tests_artifacts():
return {
"name": "e2e-tests-artifacts-upload",
"image": cloudsdk_image,
"image": images["cloudsdk_image"],
"depends_on": [
"end-to-end-tests-dashboards-suite",
"end-to-end-tests-panels-suite",
@@ -473,7 +467,7 @@ def upload_cdn_step(edition, ver_mode, trigger = None):
step = {
"name": "upload-cdn-assets" + enterprise2_suffix(edition),
"image": publish_image,
"image": images["publish_image"],
"depends_on": deps,
"environment": {
"GCP_KEY": from_secret("gcp_key"),
@@ -525,7 +519,7 @@ def build_backend_step(edition, ver_mode, variants = None):
return {
"name": "build-backend" + enterprise2_suffix(edition),
"image": build_image,
"image": images["build_image"],
"depends_on": [
"wire-install",
"compile-build-cmd",
@@ -560,7 +554,7 @@ def build_frontend_step(edition, ver_mode):
return {
"name": "build-frontend",
"image": build_image,
"image": images["build_image"],
"environment": {
"NODE_OPTIONS": "--max_old_space_size=8192",
},
@@ -598,7 +592,7 @@ def build_frontend_package_step(edition, ver_mode):
return {
"name": "build-frontend-packages",
"image": build_image,
"image": images["build_image"],
"environment": {
"NODE_OPTIONS": "--max_old_space_size=8192",
},
@@ -618,7 +612,7 @@ def build_plugins_step(edition, ver_mode):
env = None
return {
"name": "build-plugins",
"image": build_image,
"image": images["build_image"],
"environment": env,
"depends_on": [
"compile-build-cmd",
@@ -630,7 +624,7 @@ def build_plugins_step(edition, ver_mode):
],
}
def test_backend_step(image = build_image):
def test_backend_step(image = images["build_image"]):
return {
"name": "test-backend",
"image": image,
@@ -643,13 +637,13 @@ def test_backend_step(image = build_image):
}
def windows_test_backend_step():
step = test_backend_step(image = windows_go_image)
step = test_backend_step(image = images["windows_go_image"])
return step
def test_backend_integration_step():
return {
"name": "test-backend-integration",
"image": build_image,
"image": images["build_image"],
"depends_on": [
"wire-install",
],
@@ -674,7 +668,7 @@ def betterer_frontend_step(edition = "oss"):
deps.extend(["yarn-install"])
return {
"name": "betterer-frontend",
"image": build_image,
"image": images["build_image"],
"depends_on": deps,
"commands": [
"yarn betterer ci",
@@ -697,7 +691,7 @@ def test_frontend_step(edition = "oss"):
deps.extend(["yarn-install"])
return {
"name": "test-frontend",
"image": build_image,
"image": images["build_image"],
"environment": {
"TEST_MAX_WORKERS": "50%",
},
@@ -710,7 +704,7 @@ def test_frontend_step(edition = "oss"):
def lint_frontend_step():
return {
"name": "lint-frontend",
"image": build_image,
"image": images["build_image"],
"environment": {
"TEST_MAX_WORKERS": "50%",
},
@@ -758,7 +752,7 @@ def test_a11y_frontend_step(ver_mode, port = 3001):
return {
"name": "test-a11y-frontend",
# TODO which image should be used?
"image": "grafana/docker-puppeteer:1.1.0",
"image": images["docker_puppeteer_image"],
"depends_on": [
"grafana-server",
],
@@ -783,7 +777,7 @@ def frontend_metrics_step(trigger = None):
"""
step = {
"name": "publish-frontend-metrics",
"image": build_image,
"image": images["build_image"],
"depends_on": [
"test-a11y-frontend",
],
@@ -802,7 +796,7 @@ def frontend_metrics_step(trigger = None):
def codespell_step():
return {
"name": "codespell",
"image": build_image,
"image": images["build_image"],
"commands": [
# Important: all words have to be in lowercase, and separated by "\n".
'echo -e "unknwon\nreferer\nerrorstring\neror\niam\nwan" > words_to_ignore.txt',
@@ -861,7 +855,7 @@ def package_step(edition, ver_mode):
return {
"name": "package" + enterprise2_suffix(edition),
"image": build_image,
"image": images["build_image"],
"depends_on": deps,
"environment": env,
"commands": cmds,
@@ -884,7 +878,7 @@ def grafana_server_step(edition, port = 3001):
return {
"name": "grafana-server",
"image": build_image,
"image": images["build_image"],
"detach": True,
"depends_on": [
"build-plugins",
@@ -904,7 +898,7 @@ def e2e_tests_step(suite, port = 3001, tries = None):
cmd += " --tries {}".format(tries)
return {
"name": "end-to-end-tests-{}".format(suite),
"image": "cypress/included:9.5.1-node16.14.0-slim-chrome99-ff97",
"image": images["cypress_image"],
"depends_on": [
"grafana-server",
],
@@ -956,7 +950,7 @@ def cloud_plugins_e2e_tests_step(suite, cloud, trigger = None):
branch = "${DRONE_SOURCE_BRANCH}".replace("/", "-")
step = {
"name": "end-to-end-tests-{}-{}".format(suite, cloud),
"image": "us-docker.pkg.dev/grafanalabs-dev/cloud-data-sources/e2e:latest",
"image": images["cloud_datasources_e2e_image"],
"depends_on": [
"grafana-server",
],
@@ -970,7 +964,7 @@ def build_docs_website_step():
return {
"name": "build-docs-website",
# Use latest revision here, since we want to catch if it breaks
"image": "grafana/docs-base:latest",
"image": images["docs_image"],
"commands": [
"mkdir -p /hugo/content/docs/grafana",
"cp -r docs/sources/* /hugo/content/docs/grafana/latest/",
@@ -981,7 +975,7 @@ def build_docs_website_step():
def copy_packages_for_docker_step(edition = None):
return {
"name": "copy-packages-for-docker",
"image": build_image,
"image": images["build_image"],
"depends_on": [
"package" + enterprise2_suffix(edition),
],
@@ -1029,7 +1023,7 @@ def build_docker_images_step(edition, archs = None, ubuntu = False, publish = Fa
return {
"name": "build-docker-images" + ubuntu_sfx,
"image": cloudsdk_image,
"image": images["cloudsdk_image"],
"depends_on": [
"copy-packages-for-docker",
"compile-build-cmd",
@@ -1042,7 +1036,7 @@ def build_docker_images_step(edition, archs = None, ubuntu = False, publish = Fa
def fetch_images_step(edition):
return {
"name": "fetch-images-{}".format(edition),
"image": cloudsdk_image,
"image": images["cloudsdk_image"],
"environment": {
"GCP_KEY": from_secret("gcp_key"),
"DOCKER_USER": from_secret("docker_username"),
@@ -1121,7 +1115,7 @@ def publish_images_step(edition, ver_mode, mode, docker_repo, trigger = None):
step = {
"name": "publish-images-{}".format(name),
"image": cloudsdk_image,
"image": images["cloudsdk_image"],
"environment": environment,
"commands": [cmd],
"depends_on": deps,
@@ -1147,7 +1141,7 @@ def postgres_integration_tests_step():
]
return {
"name": "postgres-integration-tests",
"image": build_image,
"image": images["build_image"],
"depends_on": ["wire-install"],
"environment": {
"PGPASSWORD": "grafanatest",
@@ -1169,7 +1163,7 @@ def mysql_integration_tests_step():
]
return {
"name": "mysql-integration-tests",
"image": build_image,
"image": images["build_image"],
"depends_on": ["wire-install"],
"environment": {
"GRAFANA_TEST_DB": "mysql",
@@ -1181,7 +1175,7 @@ def mysql_integration_tests_step():
def redis_integration_tests_step():
return {
"name": "redis-integration-tests",
"image": build_image,
"image": images["build_image"],
"depends_on": ["wire-install"],
"environment": {
"REDIS_URL": "redis://redis:6379/0",
@@ -1196,7 +1190,7 @@ def redis_integration_tests_step():
def memcached_integration_tests_step():
return {
"name": "memcached-integration-tests",
"image": build_image,
"image": images["build_image"],
"depends_on": ["wire-install"],
"environment": {
"MEMCACHED_HOSTS": "memcached:11211",
@@ -1220,7 +1214,7 @@ def release_canary_npm_packages_step(trigger = None):
"""
step = {
"name": "release-canary-npm-packages",
"image": build_image,
"image": images["build_image"],
"depends_on": end_to_end_tests_deps(),
"environment": {
"NPM_TOKEN": from_secret("npm_token"),
@@ -1253,7 +1247,7 @@ def upload_packages_step(edition, ver_mode, trigger = None):
"""
step = {
"name": "upload-packages" + enterprise2_suffix(edition),
"image": publish_image,
"image": images["publish_image"],
"depends_on": end_to_end_tests_deps(),
"environment": {
"GCP_KEY": from_secret("gcp_key"),
@@ -1295,7 +1289,7 @@ def publish_grafanacom_step(edition, ver_mode):
return {
"name": "publish-grafanacom-{}".format(edition),
"image": publish_image,
"image": images["publish_image"],
"depends_on": [
"publish-linux-packages-deb",
"publish-linux-packages-rpm",
@@ -1313,7 +1307,7 @@ def publish_linux_packages_step(edition, package_manager = "deb"):
return {
"name": "publish-linux-packages-{}".format(package_manager),
# See https://github.com/grafana/deployment_tools/blob/master/docker/package-publish/README.md for docs on that image
"image": "us.gcr.io/kubernetes-dev/package-publish:latest",
"image": images["package_publish_image"],
"depends_on": ["compile-build-cmd"],
"privileged": True,
"settings": {
@@ -1335,7 +1329,7 @@ def publish_linux_packages_step(edition, package_manager = "deb"):
def windows_clone_step():
return {
"name": "clone",
"image": wix_image,
"image": images["wix_image"],
"environment": {
"GITHUB_TOKEN": from_secret("github_token"),
},
@@ -1395,7 +1389,7 @@ def get_windows_steps(edition, ver_mode):
[
{
"name": "clone",
"image": wix_image,
"image": images["wix_image"],
"environment": {
"GITHUB_TOKEN": from_secret("github_token"),
},
@@ -1403,7 +1397,7 @@ def get_windows_steps(edition, ver_mode):
},
{
"name": "windows-init",
"image": wix_image,
"image": images["wix_image"],
"commands": init_cmds,
"depends_on": ["clone"],
"environment": {"GITHUB_TOKEN": from_secret("github_token")},
@@ -1422,7 +1416,7 @@ def get_windows_steps(edition, ver_mode):
[
{
"name": "windows-init",
"image": wix_image,
"image": images["wix_image"],
"commands": init_cmds,
},
],
@@ -1497,7 +1491,7 @@ def get_windows_steps(edition, ver_mode):
steps.append(
{
"name": "build-windows-installer",
"image": wix_image,
"image": images["wix_image"],
"depends_on": [
"windows-init",
],
@@ -1515,7 +1509,7 @@ def get_windows_steps(edition, ver_mode):
def verify_gen_cue_step():
return {
"name": "verify-gen-cue",
"image": build_image,
"image": images["build_image"],
"depends_on": [],
"commands": [
"# It is required that code generated from Thema/CUE be committed and in sync with its inputs.",
@@ -1527,7 +1521,7 @@ def verify_gen_cue_step():
def verify_gen_jsonnet_step():
return {
"name": "verify-gen-jsonnet",
"image": build_image,
"image": images["build_image"],
"depends_on": [],
"commands": [
"# It is required that generated jsonnet is committed and in sync with its inputs.",
@@ -1539,7 +1533,7 @@ def verify_gen_jsonnet_step():
def trigger_test_release():
return {
"name": "trigger-test-release",
"image": build_image,
"image": images["build_image"],
"environment": {
"GITHUB_TOKEN": from_secret("github_token_pr"),
"TEST_TAG": "v0.0.0-test",
@@ -1573,7 +1567,7 @@ def trigger_test_release():
def artifacts_page_step():
return {
"name": "artifacts-page",
"image": build_image,
"image": images["build_image"],
"depends_on": [
"compile-build-cmd",
],
@@ -1601,7 +1595,7 @@ def compile_build_cmd(edition = "oss"):
]
return {
"name": "compile-build-cmd",
"image": go_image,
"image": images["go_image"],
"commands": [
"go build -o ./bin/build -ldflags '-extldflags -static' ./pkg/build/cmd",
],