diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml new file mode 100644 index 0000000..f082648 --- /dev/null +++ b/.github/workflows/build-and-test.yml @@ -0,0 +1,26 @@ +--- +name: Build and Test + +on: + pull_request: + branches: + - main + +permissions: {} + +jobs: + build-and-test: + name: Build and Test + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout + id: checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + + - name: Build and Test + id: build_and_test + shell: bash + run: | + bash scripts/build-and-test.sh diff --git a/.github/workflows/release.yml.deactivated b/.github/workflows/release.yml.deactivated index 6f2ce56..fa5a705 100644 --- a/.github/workflows/release.yml.deactivated +++ b/.github/workflows/release.yml.deactivated @@ -38,18 +38,18 @@ jobs: uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0 with: push: true - tags: ghcr.io/ministryofjustice/analytical-platform-visual-studio-code:${{ github.ref_name }} + tags: ghcr.io/ministryofjustice/analytical-platform-ingestion-scanner:${{ github.ref_name }} - name: Sign id: sign shell: bash run: | - cosign sign --yes ghcr.io/ministryofjustice/analytical-platform-visual-studio-code@${{ steps.build_and_push.outputs.digest }} + cosign sign --yes ghcr.io/ministryofjustice/analytical-platform-ingestion-scanner@${{ steps.build_and_push.outputs.digest }} - name: Verify id: verify run: | cosign verify \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ - --certificate-identity=https://github.com/ministryofjustice/analytical-platform-visual-studio-code/.github/workflows/release.yml@refs/tags/${{ github.ref_name }} \ - ghcr.io/ministryofjustice/analytical-platform-visual-studio-code@${{ steps.build_and_push.outputs.digest }} + --certificate-identity=https://github.com/ministryofjustice/analytical-platform-ingestion-scanner/.github/workflows/release.yml@refs/tags/${{ github.ref_name }} \ + ghcr.io/ministryofjustice/analytical-platform-ingestion-scanner@${{ steps.build_and_push.outputs.digest }} diff --git a/.github/workflows/scan-image.yml b/.github/workflows/scan-image.yml index 05830b5..ef1adfa 100644 --- a/.github/workflows/scan-image.yml +++ b/.github/workflows/scan-image.yml @@ -26,13 +26,13 @@ jobs: with: push: false load: true - tags: visual-studio-code + tags: ingestion-scanner - name: Scan Image id: scan_image uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d # v0.18.0 with: - image-ref: visual-studio-code + image-ref: ingestion-scanner exit-code: 1 format: sarif output: trivy-results.sarif @@ -44,7 +44,7 @@ jobs: id: scan_image_on_failure uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d # v0.18.0 with: - image-ref: visual-studio-code + image-ref: ingestion-scanner exit-code: 1 format: table severity: CRITICAL diff --git a/README.md b/README.md index c5910dd..c972773 100644 --- a/README.md +++ b/README.md @@ -2,15 +2,22 @@ [![repo standards badge](https://img.shields.io/endpoint?labelColor=231f20&color=005ea5&style=for-the-badge&label=MoJ%20Compliant&url=https%3A%2F%2Foperations-engineering-reports.cloud-platform.service.justice.gov.uk%2Fapi%2Fv1%2Fcompliant_public_repositories%2Fendpoint%2Fanalytical-platform-ingestion-scanner&logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACgAAAAoCAYAAACM/rhtAAAABmJLR0QA/wD/AP+gvaeTAAAHJElEQVRYhe2YeYyW1RWHnzuMCzCIglBQlhSV2gICKlHiUhVBEAsxGqmVxCUUIV1i61YxadEoal1SWttUaKJNWrQUsRRc6tLGNlCXWGyoUkCJ4uCCSCOiwlTm6R/nfPjyMeDY8lfjSSZz3/fee87vnnPu75z3g8/kM2mfqMPVH6mf35t6G/ZgcJ/836Gdug4FjgO67UFn70+FDmjcw9xZaiegWX29lLLmE3QV4Glg8x7WbFfHlFIebS/ANj2oDgX+CXwA9AMubmPNvuqX1SnqKGAT0BFoVE9UL1RH7nSCUjYAL6rntBdg2Q3AgcAo4HDgXeBAoC+wrZQyWS3AWcDSUsomtSswEtgXaAGWlVI2q32BI0spj9XpPww4EVic88vaC7iq5Hz1BvVf6v3qe+rb6ji1p3pWrmtQG9VD1Jn5br+Knmm70T9MfUh9JaPQZu7uLsR9gEsJb3QF9gOagO7AuUTom1LpCcAkoCcwQj0VmJregzaipA4GphNe7w/MBearB7QLYCmlGdiWSm4CfplTHwBDgPHAFmB+Ah8N9AE6EGkxHLhaHU2kRhXc+cByYCqROs05NQq4oR7Lnm5xE9AL+GYC2gZ0Jmjk8VLKO+pE4HvAyYRnOwOH5N7NhMd/WKf3beApYBWwAdgHuCLn+tatbRtgJv1awhtd838LEeq30/A7wN+AwcBt+bwpD9AdOAkYVkpZXtVdSnlc7QI8BlwOXFmZ3oXkdxfidwmPrQXeA+4GuuT08QSdALxC3OYNhBe/TtzON4EziZBXD36o+q082BxgQuqvyYL6wtBY2TyEyJ2DgAXAzcC1+Xxw3RlGqiuJ6vE6QS9VGZ/7H02DDwAvELTyMDAxbfQBvggMAAYR9LR9J2cluH7AmnzuBowFFhLJ/wi7yiJgGXBLPq8A7idy9kPgvAQPcC9wERHSVcDtCfYj4E7gr8BRqWMjcXmeB+4tpbyG2kG9Sl2tPqF2Uick8B+7szyfvDhR3Z7vvq/2yqpynnqNeoY6v7LvevUU9QN1fZ3OTeppWZmeyzRoVu+rhbaHOledmoQ7LRd3SzBVeUo9Wf1DPs9X90/jX8m/e9Rn1Mnqi7nuXXW5+rK6oU7n64mjszovxyvVh9WeDcTVnl5KmQNcCMwvpbQA1xE8VZXhwDXAz4FWIkfnAlcBAwl6+SjD2wTcmPtagZnAEuA3dTp7qyNKKe8DW9UeBCeuBsbsWKVOUPvn+MRKCLeq16lXqLPVFvXb6r25dlaGdUx6cITaJ8fnpo5WI4Wuzcjcqn5Y8eI/1F+n3XvUA1N3v4ZamIEtpZRX1Y6Z/DUK2g84GrgHuDqTehpBCYend94jbnJ34DDgNGArQT9bict3Y3p1ZCnlSoLQb0sbgwjCXpY2blc7llLW1UAMI3o5CD4bmuOlwHaC6xakgZ4Z+ibgSxnOgcAI4uavI27jEII7909dL5VSrimlPKgeQ6TJCZVQjwaOLaW8BfyWbPEa1SaiTH1VfSENd85NDxHt1plA71LKRvX4BDaAKFlTgLeALtliDUqPrSV6SQCBlypgFlbmIIrCDcAl6nPAawmYhlLKFuB6IrkXAadUNj6TXlhDcCNEB/Jn4FcE0f4UWEl0NyWNvZxGTs89z6ZnatIIrCdqcCtRJmcCPwCeSN3N1Iu6T4VaFhm9n+riypouBnepLsk9p6p35fzwvDSX5eVQvaDOzjnqzTl+1KC53+XzLINHd65O6lD1DnWbepPBhQ3q2jQyW+2oDkkAtdt5udpb7W+Q/OFGA7ol1zxu1tc8zNHqXercfDfQIOZm9fR815Cpt5PnVqsr1F51wI9QnzU63xZ1o/rdPPmt6enV6sXqHPVqdXOCe1rtrg5W7zNI+m712Ir+cer4POiqfHeJSVe1Raemwnm7xD3mD1E/Z3wIjcsTdlZnqO8bFeNB9c30zgVG2euYa69QJ+9G90lG+99bfdIoo5PU4w362xHePxl1slMab6tV72KUxDvzlAMT8G0ZohXq39VX1bNzzxij9K1Qb9lhdGe931B/kR6/zCwY9YvuytCsMlj+gbr5SemhqkyuzE8xau4MP865JvWNuj0b1YuqDkgvH2GkURfakly01Cg7Cw0+qyXxkjojq9Lw+vT2AUY+DlF/otYq1Ixc35re2V7R8aTRg2KUv7+ou3x/14PsUBn3NG51S0XpG0Z9PcOPKWSS0SKNUo9Rv2Mmt/G5WpPF6pHGra7Jv410OVsdaz217AbkAPX3ubkm240belCuudT4Rp5p/DyC2lf9mfq1iq5eFe8/lu+K0YrVp0uret4nAkwlB6vzjI/1PxrlrTp/oNHbzTJI92T1qAT+BfW49MhMg6JUp7ehY5a6Tl2jjmVvitF9fxo5Yq8CaAfAkzLMnySt6uz/1k6bPx59CpCNxGfoSKA30IPoH7cQXdArwCOllFX/i53P5P9a/gNkKpsCMFRuFAAAAABJRU5ErkJggg==)](https://operations-engineering-reports.cloud-platform.service.justice.gov.uk/public-report/analytical-platform-ingestion-scanner) -This image is used in the Analytical Platform Ingestion Service. It is deployed as a Lambda function within the `analytical-platform-ingestion` account and is called as part of the AWS Transfer Family Server workflows. +This image is used in the Analytical Platform Ingestion service. It is deployed as an AWS Lambda function within the `analytical-platform-ingestion` account and is called as part of the AWS Transfer Family Server workflows. ## Features + The image comes with two key features - Syncing and Scanning. ### Syncing +- `definition_upload` pulls latest ClamAV definitions, archives them, and pushes to Amazon S3. + +- `definition_download` downloads archived ClamAV definitions from Amazon S3, and unpacks them. + ### Scanning +- `scan` _TBC_ + ## Running Locally ### Build @@ -49,5 +56,5 @@ docker run -it --rm --platform linux/amd64 public.ecr.aws/lambda/provided:al2023 microdnf update -apt-cache policy ${PACKAGE} # for example curl, git or gpg +microdnf repoquery ${PACKAGE} # for example clamav, clamav-update or clamd ``` diff --git a/scripts/build-and-test.sh b/scripts/build-and-test.sh new file mode 100644 index 0000000..a8a641f --- /dev/null +++ b/scripts/build-and-test.sh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash + +IMAGE_TAG="analytical-platform.service.justice.gov.uk/ingestion-scanner:local" +CONTAINER_STRUCTURE_TEST_IMAGE="gcr.io/gcp-runtimes/container-structure-test:latest" + +if [[ "${REMOTE_CONTAINERS}" ]] && [[ "$(uname -m)" == "aarch64" ]]; then + echo "(⚠) Looks like you're running in a dev container on Apple Silicon." + echo "(⚠) This script builds linux/amd64 images which might take a long time or even fail." + export PLATFORM_FLAG="--platform linux/amd64" +fi +# shellcheck disable=SC2086 +# special case for PLATFORM_FLAG as it can't parse double quotes +docker build ${PLATFORM_FLAG} --file Dockerfile --tag "${IMAGE_TAG}" . + +echo "Running container structure test for [ ${IMAGE_TAG} ]" + +# shellcheck disable=SC2086 +# special case for PLATFORM_FLAG as it can't parse double quotes +docker run --rm ${PLATFORM_FLAG} \ + --volume /var/run/docker.sock:/var/run/docker.sock \ + --volume "${PWD}:/workspace" \ + --workdir /workspace \ + "${CONTAINER_STRUCTURE_TEST_IMAGE}" \ + test --image "${IMAGE_TAG}" --config "/workspace/test/container-structure-test.yml" diff --git a/test/container-structure-test.yml b/test/container-structure-test.yml new file mode 100644 index 0000000..ee2a69b --- /dev/null +++ b/test/container-structure-test.yml @@ -0,0 +1,8 @@ +--- +schemaVersion: 2.0.0 + +commandTests: + - name: "aws" + command: "aws" + args: ["--version"] + expectedOutput: ["aws-cli/2.15.23.*"]