diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 196219d..2966b55 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -6,6 +6,29 @@ on: - '*' jobs: + run_snyk: + if: ${{ !contains(github.ref, 'rc') }} + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + - uses: coursier/cache-action@v3 + - name: Set up JDK + uses: actions/setup-java@v1 + with: + java-version: 8 + + - name: Build local image, which is needed to run Snyk + run: sbt "project distroless" docker:publishLocal + + - name: Run Snyk to check for vulnerabilities + uses: snyk/actions/docker@master + with: + image: "snowplow/snowplow-google-cloud-storage-loader:${{ github.ref_name }}-distroless" + args: "--app-vulns --org=data-processing-new" + command: monitor + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + deploy_docker: runs-on: ubuntu-latest steps: diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml deleted file mode 100644 index 596c376..0000000 --- a/.github/workflows/snyk.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: Snyk - -on: - push: - branches: [ master ] - -jobs: - security: - runs-on: ubuntu-latest - - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - - steps: - - name: Checkout - uses: actions/checkout@v2 - - - name: Install Snyk - run: sudo npm install -g snyk - - - name: Add correct sbt-dependency-graph version - run: mkdir -p $HOME/.sbt/1.0/plugins && echo 'addSbtPlugin("net.virtual-void" % "sbt-dependency-graph" % "0.10.0-RC1")' >> $HOME/.sbt/1.0/plugins/plugins.sbt - - - name: Run Snyk to check for vulnerabilities - run: snyk monitor --project-name=snowplow-google-cloud-storage-loader diff --git a/CHANGELOG b/CHANGELOG index ea45162..42b7f84 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,12 @@ +Version 0.5.5 (2023-12-07) +-------------------------- +Bump scio to 0.13.6 (#95) +Bump beam to 2.52.0 (#95) +Bump netty to 4.1.101.Final (#95) +Bump org.json.json to 20231013 (#95) +Use sbt-snowplow-release to build docker images (#96) +Scan Docker images in Snyk Github action (#97) + Version 0.5.4 (2022-11-03) -------------------------- Bump snakeyaml to 1.33 (#91) diff --git a/README.md b/README.md index ff5e6eb..f7f28cb 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,7 @@ A container can be run as follows: docker run \ -v $PWD/config:/snowplow/config \ -e GOOGLE_APPLICATION_CREDENTIALS=/snowplow/config/credentials.json \ # if running outside GCP - snowplow/snowplow-google-cloud-storage-loader:0.5.4 \ + snowplow/snowplow-google-cloud-storage-loader:0.5.5 \ --runner=DataFlowRunner \ --jobName=[JOB-NAME] \ --project=[PROJECT] \ @@ -62,14 +62,14 @@ docker run \ To display the help message: ```bash -docker run snowplow/snowplow-google-cloud-storage-loader:0.5.4 \ +docker run snowplow/snowplow-google-cloud-storage-loader:0.5.5 \ --help ``` To display documentation about Cloud Storage Loader-specific options: ```bash -docker run snowplow/snowplow-google-cloud-storage-loader:0.5.4 \ +docker run snowplow/snowplow-google-cloud-storage-loader:0.5.5 \ --help=com.snowplowanalytics.storage.googlecloudstorage.loader.Options ``` diff --git a/build.sbt b/build.sbt index 8d5d9c9..8903d6c 100644 --- a/build.sbt +++ b/build.sbt @@ -5,8 +5,7 @@ lazy val root: Project = project .settings(BuildSettings.commonSettings) .settings(BuildSettings.macroSettings) .settings(BuildSettings.appSettings) - .settings(BuildSettings.dockerSettingsFocal) - .enablePlugins(JavaAppPackaging) + .enablePlugins(JavaAppPackaging, SnowplowDockerPlugin) lazy val distroless: Project = project .in(file("distroless")) @@ -14,8 +13,7 @@ lazy val distroless: Project = project .settings(BuildSettings.commonSettings) .settings(BuildSettings.macroSettings) .settings(BuildSettings.appSettings) - .settings(BuildSettings.dockerSettingsDistroless) - .enablePlugins(DockerPlugin, LauncherJarPlugin) + .enablePlugins(JavaAppPackaging, SnowplowDistrolessDockerPlugin) lazy val repl: Project = project .in(file(".repl")) diff --git a/project/BuildSettings.scala b/project/BuildSettings.scala index c896b7b..4b75208 100644 --- a/project/BuildSettings.scala +++ b/project/BuildSettings.scala @@ -15,12 +15,8 @@ import sbt._ import sbt.Keys._ -import com.typesafe.sbt.packager.archetypes.jar.LauncherJarPlugin.autoImport.packageJavaLauncherJar import com.typesafe.sbt.packager.docker.DockerPlugin.autoImport._ -import com.typesafe.sbt.packager.docker.DockerPermissionStrategy -import com.typesafe.sbt.packager.docker.ExecCmd import com.typesafe.sbt.SbtNativePackager.autoImport._ -import com.typesafe.sbt.packager.linux.LinuxPlugin.autoImport._ import sbtdynver.DynVerPlugin.autoImport._ object BuildSettings { @@ -50,6 +46,7 @@ object BuildSettings { lazy val appSettings = Seq( name := "snowplow-google-cloud-storage-loader", + Docker / packageName := "snowplow-google-cloud-storage-loader", description := "Snowplow Google Cloud Storage Loader", publish / skip := true, ThisBuild / dynverVTagPrefix := false, // Otherwise git tags required to have v-prefix @@ -64,6 +61,8 @@ object BuildSettings { Dependencies.Libraries.googleOauth, Dependencies.Libraries.guava, Dependencies.Libraries.snakeYaml, + Dependencies.Libraries.nettyCodec, + Dependencies.Libraries.orgJson, Dependencies.Libraries.scioTest, Dependencies.Libraries.scalatest, Dependencies.Libraries.mockito @@ -78,29 +77,6 @@ object BuildSettings { Compile / mainClass := Some("com.spotify.scio.repl.ScioShell"), ) - lazy val dockerSettingsFocal = Seq( - dockerRepository := Some("snowplow"), - dockerBaseImage := "eclipse-temurin:11-jre-focal", - Docker / packageName := "snowplow-google-cloud-storage-loader", - Docker / maintainer := "Snowplow Analytics Ltd. ", - Docker / daemonUser := "snowplow", - Docker / defaultLinuxInstallLocation := "/home/snowplow", - dockerUpdateLatest := true - ) - - lazy val dockerSettingsDistroless = Seq( - Docker / maintainer := "Snowplow Analytics Ltd. ", - dockerBaseImage := "gcr.io/distroless/java11-debian11:nonroot", - Docker / daemonUser := "nonroot", - Docker / daemonGroup := "nonroot", - dockerRepository := Some("snowplow"), - Docker / daemonUserUid := None, - Docker / defaultLinuxInstallLocation := "/home/snowplow", - dockerEntrypoint := Seq("java", "-jar",s"/home/snowplow/lib/${(packageJavaLauncherJar / artifactPath).value.getName}"), - dockerPermissionStrategy := DockerPermissionStrategy.CopyChown, - dockerAlias := dockerAlias.value.copy(tag = dockerAlias.value.tag.map(t => s"$t-distroless")), - ) - lazy val macroSettings = Seq( libraryDependencies += Dependencies.Libraries.reflect % scalaVersion.value, addCompilerPlugin(Dependencies.Libraries.paradise cross CrossVersion.full) diff --git a/project/Dependencies.scala b/project/Dependencies.scala index 77e1a1a..0ff4eca 100644 --- a/project/Dependencies.scala +++ b/project/Dependencies.scala @@ -18,8 +18,8 @@ import sbt._ object Dependencies { object V { - val scio = "0.12.0" - val beam = "2.41.0" + val scio = "0.13.6" + val beam = "2.52.0" val scalaMacros = "2.1.1" val slf4j = "1.7.36" val scalatest = "3.2.10" @@ -30,6 +30,8 @@ object Dependencies { val googleOauth = "1.34.0" // An override, to mitigate a CVE val guava = "31.1-jre" // An override, to mitigate a CVE val snakeYaml = "1.33" // An override, to mitigate a CVE + val nettyCodec = "4.1.101.Final" // An override, to mitigate a CVE + val orgJson = "20231013" // An override, to mitigate a CVE val paradise = "2.1.1" } @@ -52,6 +54,8 @@ object Dependencies { val googleOauth = "com.google.oauth-client" % "google-oauth-client" % V.googleOauth val guava = "com.google.guava" % "guava" % V.guava val snakeYaml = "org.yaml" % "snakeyaml" % V.snakeYaml + val nettyCodec = "io.netty" % "netty-codec-http2" % V.nettyCodec + val orgJson = "org.json" % "json" % V.orgJson val reflect = "org.scala-lang" % "scala-reflect" // Test diff --git a/project/plugins.sbt b/project/plugins.sbt index fa5839b..6100dbf 100644 --- a/project/plugins.sbt +++ b/project/plugins.sbt @@ -1,3 +1,3 @@ addSbtPlugin("org.scalastyle" %% "scalastyle-sbt-plugin" % "1.0.0") -addSbtPlugin("com.github.sbt" % "sbt-native-packager" % "1.9.7") addSbtPlugin("com.dwijnand" % "sbt-dynver" % "4.1.1") +addSbtPlugin("com.snowplowanalytics" % "sbt-snowplow-release" % "0.3.1")