improve build scripts and migrate from Travis to GitHub Actions

2026-05-21 12:14:16 +02:00 · 2020-12-05 21:58:04 +01:00 · 2020-12-05 21:58:04 +01:00 · 6b40e26bb0
commit 6b40e26bb0
parent b46121d46f
8 changed files with 177 additions and 111 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@ -0,0 +1,49 @@
+# https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions
+name: Build
+
+on:
+  push:
+    paths-ignore:
+    - '**/*.md'
+  schedule:
+    # https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+    # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
+
+env:
+  DOCKER_IMAGE_REPO: vegardit/openldap
+  DOCKER_IMAGE_TAG: latest
+  TRIVY_CACHE_DIR: ~/.trivy/cache
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Git Checkout
+      uses: actions/checkout@v2 #https://github.com/actions/checkout
+
+    - name: Cache trivy cache
+      uses: actions/cache@v2
+      with:
+        path: ${{ env.TRIVY_CACHE_DIR }}
+        # https://github.com/actions/cache/issues/342#issuecomment-673371329
+        key: ${{ runner.os }}-trivy-${{ github.run_id }}
+        restore-keys: |
+          ${{ runner.os }}-trivy-
+
+    - name: Install dos2unix
+      run: sudo apt-get install --no-install-recommends -y dos2unix
+
+    - name: Build ${{ env.DOCKER_IMAGE_REPO }}:${{ env.DOCKER_IMAGE_TAG }}
+      shell: bash
+      env:
+        DOCKER_PUSH: 1
+        DOCKER_REGISTRY: docker.io
+        DOCKER_REGISTRY_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+        DOCKER_REGISTRY_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
+        MICROBADGER_TOKEN: ${{ secrets.MICROBADGER_TOKEN }}
+      run: |
+        echo "$DOCKER_REGISTRY_TOKEN" | docker login -u="$DOCKER_REGISTRY_USERNAME" "$DOCKER_REGISTRY" --password-stdin
+        bash build-image.sh
+        curl -X POST https://hooks.microbadger.com/images/$DOCKER_REPO/$MICROBADGER_TOKEN || true;
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,35 @@
-/.project
-/.settings
-/.svn
+# Local work folder that is not checked in
+_LOCAL/
+
+# Eclipse
+.apt_generated/
+.checkstyle
+.classpath
+.factorypath
+.project
+.settings/
+bin/
 **/.*.md.html
+
+# IntelliJ
+.idea
+*.iml
+*.ipr
+*.iws
+
+# NetBeans
+nb-configuration.xml
+
+# Visual Studio Code
+.vscode
+
+# OSX
+.DS_Store
+
+# Vim
+*.swo
+*.swp
+
+# patch
+*.orig
+*.rej
--- a/.travis.yml
+++ b/.travis.yml
@ -1,46 +0,0 @@
-# https://github.com/travis-ci/travis-yml/blob/master/schema.json
-language: bash # using 'bash' instead of 'minimal' to prevent https://travis-ci.community/t/job-stuck-booting/4976
-
-addons:
-  apt:
-    packages:
-    - dos2unix
-
-
-services:
-  - docker
-
-
-cache:
-  directories:
-    - $HOME/.trivy/cache
-
-
-env:
-  global:
-    DOCKER_REGISTRY=docker.io
-    DOCKER_REPO=vegardit/openldap
-    TRIVY_CACHE_DIR=$HOME/.trivy/cache
-
-
-before_script:
- # workaround for
- # - https://stackoverflow.com/questions/34130613/how-to-make-travis-ci-work-with-a-local-git-branch-instead-of-a-specific-commit
- # - https://unhashable.com/getting-the-current-branch-name-during-a-pull-request-in-travis-ci/
- - if [ "$TRAVIS_PULL_REQUEST" == "false" ]; then
-     export GIT_BRANCH="$TRAVIS_BRANCH";
-   else
-     export GIT_BRANCH="$TRAVIS_PULL_REQUEST_BRANCH";
-   fi
- #- printenv | sort
- - mkdir -p "$TRIVY_CACHE_DIR"
-
-
-script:
- - echo "$DOCKER_PASSWORD" | docker login -u="$DOCKER_USERNAME" "$DOCKER_REGISTRY" --password-stdin &&
-   if [[ "$TRAVIS_BRANCH" == "master" ]]; then
-     DOCKER_PUSH=1 bash ./build-image.sh;
-     curl -X POST https://hooks.microbadger.com/images/$DOCKER_REPO/$MICROBADGER_TOKEN || true;
-   else 
-     bash ./build-image.sh;
-   fi
--- a/README.md
+++ b/README.md
@ -1,6 +1,6 @@
 # vegardit/openldap <a href="https://github.com/vegardit/docker-openldap/" title="GitHub Repo"><img height="30" src="https://raw.githubusercontent.com/simple-icons/simple-icons/develop/icons/github.svg?sanitize=true"></a>

-[![Build Status](https://travis-ci.com/vegardit/docker-openldap.svg?branch=master "Travis CI")](https://travis-ci.com/vegardit/docker-openldap)
+[![Build Status](https://github.com/vegardit/docker-openldap/workflows/Build/badge.svg "GitHub Actions")](https://github.com/vegardit/docker-openldap/actions?query=workflow%3ABuild)
 [![License](https://img.shields.io/github/license/vegardit/docker-openldap.svg?label=license)](#license)
 [![Docker Pulls](https://img.shields.io/docker/pulls/vegardit/openldap.svg)](https://hub.docker.com/r/vegardit/openldap)
 [![Docker Stars](https://img.shields.io/docker/stars/vegardit/openldap.svg)](https://hub.docker.com/r/vegardit/openldap)
--- a/build-debug-image.sh
+++ b/build-debug-image.sh
@ -3,7 +3,7 @@
 # Copyright 2019-2020 by Vegard IT GmbH, Germany, https://vegardit.com
 # SPDX-License-Identifier: Apache-2.0
 #
-# @author Sebastian Thomschke, Vegard IT GmbH
+# Author: Sebastian Thomschke, Vegard IT GmbH
 #
 # https://github.com/vegardit/docker-openldap
 #
--- a/build-image.sh
+++ b/build-image.sh
@ -3,114 +3,131 @@
 # Copyright 2019-2020 by Vegard IT GmbH, Germany, https://vegardit.com
 # SPDX-License-Identifier: Apache-2.0
 #
-# @author Sebastian Thomschke, Vegard IT GmbH
+# Author: Sebastian Thomschke, Vegard IT GmbH
 #
 # https://github.com/vegardit/docker-openldap
 #

-set -e -u -x
+set -eu

-##############################
+#################################################
 # execute script with bash if loaded with other shell interpreter
-##############################
-if [ ! -n "$BASH" ]; then /usr/bin/env bash "$0" "$@"; exit; fi
+#################################################
+if [ -z "${BASH_VERSINFO:-}" ]; then /usr/bin/env bash "$0" "$@"; exit; fi

 set -o pipefail

 trap 'echo >&2 "$(date +%H:%M:%S) Error - exited with status $? at line $LINENO:"; pr -tn $0 | tail -n+$((LINENO - 3)) | head -n7' ERR


-##############################
+#################################################
 # specify target docker registry/repo
-##############################
+#################################################
 docker_registry=${DOCKER_REGISTRY:-docker.io}
-docker_repo=${DOCKER_REPO:-vegardit/openldap}
+image_repo=${DOCKER_IMAGE_REPO:-vegardit/openldap}
+image_name=$image_repo:${DOCKER_IMAGE_TAG:-latest}


-##############################
+#################################################
 # determine directory of current script
-##############################
+#################################################
 project_root=$(readlink -e $(dirname "${BASH_SOURCE[0]}"))


-##############################
+#################################################
 # ensure Linux new line chars
-##############################
+#################################################
 # env -i PATH="$PATH" -> workaround for "find: The environment is too large for exec()"
 env -i PATH="$PATH" find "$project_root/image" -type f -exec dos2unix {} \;


-##############################
+#################################################
+# calculate BASE_LAYER_CACHE_KEY
+#################################################
+# using the current date, i.e. the base layer cache (that holds system packages with security updates) will be invalidate once per day
+base_layer_cache_key=$(date +%Y%m%d)
+
+
+#################################################
 # build the image
-##############################
+#################################################
+echo "Building docker image [$image_name]..."
+if [[ $OSTYPE == "cygwin" || $OSTYPE == "msys" ]]; then
+   project_root=$(cygpath -w "$project_root")
+fi
+
 docker build "$project_root/image" \
   --pull \
-   --compress \
   `# using the current date as value for BASE_LAYER_CACHE_KEY, i.e. the base layer cache (that holds system packages with security updates) will be invalidate once per day` \
-   --build-arg BASE_LAYER_CACHE_KEY=$(date +%Y%m%d) \
+   --build-arg BASE_LAYER_CACHE_KEY=$base_layer_cache_key \
   --build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
   --build-arg GIT_BRANCH="${GIT_BRANCH:-$(git rev-parse --abbrev-ref HEAD)}" \
   --build-arg GIT_COMMIT_DATE="$(date -d @$(git log -1 --format='%at') --utc +'%Y-%m-%d %H:%M:%S UTC')" \
   --build-arg GIT_COMMIT_HASH="$(git rev-parse --short HEAD)" \
   --build-arg GIT_REPO_URL="$(git config --get remote.origin.url)" \
-   -t $docker_repo:latest \
+   -t $image_name \
   "$@"


-##############################
+#################################################
 # perform security audit using https://github.com/aquasecurity/trivy
-##############################
+#################################################
 if [[ $OSTYPE != cygwin ]] && [[ $OSTYPE != msys ]]; then
-   trivy_cache_dir=${TRIVY_CACHE_DIR:-$HOME/.trivy/cache}
+   trivy_cache_dir="${TRIVY_CACHE_DIR:-$HOME/.trivy/cache}"
+   trivy_cache_dir="${trivy_cache_dir/#\~/$HOME}"
   mkdir -p "$trivy_cache_dir"
   docker run --rm \
-      -v /var/run/docker.sock:/var/run/docker.sock \
+      -v /var/run/docker.sock:/var/run/docker.sock:ro \
      -v "$trivy_cache_dir:/root/.cache/" \
-      aquasec/trivy --no-progress --exit-code 0 --severity HIGH,CRITICAL $docker_repo:latest
+      aquasec/trivy --no-progress --exit-code 0 --severity HIGH,CRITICAL $image_name
   docker run --rm \
-      -v /var/run/docker.sock:/var/run/docker.sock \
+      -v /var/run/docker.sock:/var/run/docker.sock:ro \
      -v "$trivy_cache_dir:/root/.cache/" \
-      aquasec/trivy --no-progress --ignore-unfixed --exit-code 1 --severity HIGH,CRITICAL $docker_repo:latest
+      aquasec/trivy --no-progress --ignore-unfixed --exit-code 1 --severity HIGH,CRITICAL $image_name
   sudo chown -R $USER:$(id -gn) "$trivy_cache_dir" || true
 fi


-##############################
+#################################################
 # determine effective LDAP version and apply tags
-##############################
+#################################################
 # LC_ALL=en_US.utf8 -> workaround for "grep: -P supports only unibyte and UTF-8 locales"
-ldap_version=$(docker run --rm $docker_repo:latest "dpkg -s slapd | grep 'Version:' | LC_ALL=en_US.utf8 grep -oP 'Version: \K\d+\.\d+\.\d+'")
-docker image tag $docker_repo:latest $docker_repo:${ldap_version%.*}.x  #2.4.x
-docker image tag $docker_repo:latest $docker_repo:${ldap_version%%.*}.x #2.x
+ldap_version=$(docker run --rm $image_name "dpkg -s slapd | grep 'Version:' | LC_ALL=en_US.utf8 grep -oP 'Version: \K\d+\.\d+\.\d+'")
+docker image tag $image_name $image_repo:${ldap_version%.*}.x  #2.4.x
+docker image tag $image_name $image_repo:${ldap_version%%.*}.x #2.x


-##############################
-# push image with tags to remote docker registry
-##############################
+#################################################
+# push image with tags to remote docker image registry
+#################################################
 if [[ "${DOCKER_PUSH:-0}" == "1" ]]; then
-   docker image tag $docker_repo:latest $docker_registry/$docker_repo:latest
-   docker image tag $docker_repo:latest $docker_registry/$docker_repo:${ldap_version}       #2.4.47
-   docker image tag $docker_repo:latest $docker_registry/$docker_repo:${ldap_version%.*}.x  #2.4.x
-   docker image tag $docker_repo:latest $docker_registry/$docker_repo:${ldap_version%%.*}.x #2.x
+   docker image tag $image_name $docker_registry/$image_name
+   docker image tag $image_name $docker_registry/$image_repo:${ldap_version}       #2.4.47
+   docker image tag $image_name $docker_registry/$image_repo:${ldap_version%.*}.x  #2.4.x
+   docker image tag $image_name $docker_registry/$image_repo:${ldap_version%%.*}.x #2.x

-   docker push $docker_registry/$docker_repo:latest
-   docker push $docker_registry/$docker_repo:${ldap_version}       #2.4.47
-   docker push $docker_registry/$docker_repo:${ldap_version%.*}.x  #2.4.x
-   docker push $docker_registry/$docker_repo:${ldap_version%%.*}.x #2.x
+   docker push $docker_registry/$image_name
+   docker push $docker_registry/$image_repo:${ldap_version}       #2.4.47
+   docker push $docker_registry/$image_repo:${ldap_version%.*}.x  #2.4.x
+   docker push $docker_registry/$image_repo:${ldap_version%%.*}.x #2.x
 fi


-#############################
+#################################################
 # remove untagged images
-#############################
+#################################################
 # http://www.projectatomic.io/blog/2015/07/what-are-docker-none-none-images/
-docker rmi $(docker images -f "dangling=true" -q) || true
+untagged_images=$(docker images -f "dangling=true" -q --no-trunc)
+[[ -n $untagged_images ]] && docker rmi $untagged_images || true


-#############################
+#################################################
 # display some image information
-#############################
+#################################################
 echo ""
-docker images "$docker_repo"
+echo "IMAGE NAME"
+echo "$image_name"
 echo ""
-docker history "$docker_repo:latest"
+docker images "$image_repo"
+echo ""
+docker history "$image_name"
--- a/image/Dockerfile
+++ b/image/Dockerfile
@ -1,7 +1,7 @@
 # Copyright 2019-2020 by Vegard IT GmbH, Germany, https://vegardit.com
 # SPDX-License-Identifier: Apache-2.0
 #
-# @author Sebastian Thomschke, Vegard IT GmbH
+# Author: Sebastian Thomschke, Vegard IT GmbH
 #
 # https://github.com/vegardit/docker-openldap
 #
@ -29,14 +29,19 @@ ARG LC_ALL=C
 ARG BASE_LAYER_CACHE_KEY

 RUN \
-  set -x && \
-  ############################################################
+  set -eu && \
+  echo "#################################################" && \
  echo "Installing OS updates..." && \
-  apt-get -y update && \
-  apt-get -y upgrade && \
-  ############################################################
+  echo "#################################################" && \
+  apt-get update -y && \
+  # https://github.com/phusion/baseimage-docker/issues/319
+  apt-get install --no-install-recommends -y apt-utils 2> >( grep -v 'debconf: delaying package configuration, since apt-utils is not installed' >&2 ) && \
+  apt-get upgrade -y && \
+  #
  if [ "${DEBUG_BUILD}" = "1" ]; then \
+     echo "#################################################" && \
     echo "Installing debugging tools..." && \
+     echo "#################################################" && \
     apt-get install --no-install-recommends -y libcomerr2 mc && \
     apt-get install --no-install-recommends -y htop less procps vim && \
     echo -e 'set ignorecase\n\
@ -46,16 +51,19 @@ set noerrorbells\n\
 syntax enable\n\
 set mouse-=a' > ~/.vimrc; \
  fi && \
-  ############################################################
+  echo "#################################################" && \
  echo "Installing slapd..." && \
+  echo "#################################################" && \
  echo 'slapd slapd/root_password password whatever' | debconf-set-selections && \
  echo 'slapd slapd/root_password_again password whatever' | debconf-set-selections && \
  apt-get install --no-install-recommends -y slapd ldap-utils && \
  echo "OpenLDAP $(apt-cache show slapd | grep Version)" >> /opt/build_info  && \
  # workaround for 'service slapd stop' not working, see https://stackoverflow.com/a/58792698/5116073
  sed -i 's/--exec $SLAPD 2/--name slapd 2/' /etc/init.d/slapd && \
-  ############################################################
+  #
+  echo "#################################################" && \
  echo "Installing pqChecker password quality checker module..." && \
+  echo "#################################################" && \
  # https://www.meddeb.net/pqchecker/
  apt-get install --no-install-recommends -y curl && \
  curl -k -o /tmp/pqchecker.deb -SL "${PQCHECKER_URL}" && \
@ -63,18 +71,25 @@ set mouse-=a' > ~/.vimrc; \
  dpkg -i /tmp/pqchecker.deb && \
  rm /tmp/pqchecker.deb && \
  apt-get remove --auto-remove -y curl && \
-  ############################################################
+  #
+  echo "#################################################" && \
  echo "Moving config and data directories..." && \
+  echo "#################################################" && \
  mv /etc/ldap/slapd.d /etc/ldap/slapd.d_orig && \
  mkdir /etc/ldap/slapd.d && \
  mv /var/lib/ldap /var/lib/ldap_orig && \
  mkdir /var/lib/ldap && \
-  ############################################################
+  #
+  echo "#################################################" && \
  echo "apt-get clean up..." && \
+  echo "#################################################" && \
+  apt-get remove apt-utils -y && \
  apt-get clean autoclean && \
  apt-get autoremove --purge -y && \
-  ############################################################
+  #
+  echo "#################################################" && \
  echo "Removing logs, caches and temp files..." && \
+  echo "#################################################" && \
  rm -rf /var/cache/{apt,debconf} \
     /var/lib/apt/lists/* \
     /var/log/{apt,alternatives.log,bootstrap.log,dpkg.log} \
@ -132,4 +147,4 @@ EXPOSE 389
 ENTRYPOINT ["/bin/sh", "-c"]

 # exec is required for propagating SIGTERM from docker to child process
-CMD ["exec /bin/bash /opt/run.sh"]
+CMD ["exec /bin/bash /opt/run.sh"]
--- a/image/run.sh
+++ b/image/run.sh
@ -3,7 +3,7 @@
 # Copyright 2019-2020 by Vegard IT GmbH, Germany, https://vegardit.com
 # SPDX-License-Identifier: Apache-2.0
 #
-# @author Sebastian Thomschke, Vegard IT GmbH
+# Author: Sebastian Thomschke, Vegard IT GmbH
 #
 # https://github.com/vegardit/docker-openldap
 #