Skip to content

Commit 01e05b1

Browse files
anthony-nhsanthony-nhs
committed
add makefiles
1 parent e0808a3 commit 01e05b1

12 files changed

Lines changed: 232 additions & 27 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ CONTAINER_NAME=base \
154154
```
155155
Language images
156156
```
157-
CONTAINER_NAME=node_24_python_3_13 \
157+
CONTAINER_NAME=node_24_python_3_14 \
158158
BASE_VERSION_TAG=local-build \
159159
BASE_FOLDER=languages \
160160
IMAGE_TAG=local-build \

‎src/base/.devcontainer/Dockerfile‎

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,39 +2,37 @@ FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
22

33
ARG SCRIPTS_DIR=/usr/local/share/eps
44
ARG CONTAINER_NAME
5-
ARG MULTI_ARCH_TAG
6-
ARG BASE_VERSION_TAG
75
ARG IMAGE_TAG
86
ARG TARGETARCH
97

108
ENV SCRIPTS_DIR=${SCRIPTS_DIR}
119
ENV CONTAINER_NAME=${CONTAINER_NAME}
12-
ENV MULTI_ARCH_TAG=${MULTI_ARCH_TAG}
13-
ENV BASE_VERSION_TAG=${BASE_VERSION_TAG}
14-
ENV IMAGE_TAG=${IMAGE_TAG}
1510
ENV TARGETARCH=${TARGETARCH}
1611

17-
LABEL org.opencontainers.image.source=https://github.com/NHSDigital/eps-devcontainers
18-
LABEL org.opencontainers.image.description="EPS devcontainer ${CONTAINER_NAME}:${IMAGE_TAG}"
19-
LABEL org.opencontainers.image.licenses=MIT
20-
LABEL org.opencontainers.image.version=${IMAGE_TAG}
21-
LABEL org.opencontainers.image.containerName=${CONTAINER_NAME}
22-
LABEL org.opencontainers.image.authors="NHS England EPS Team"
23-
LABEL org.opencontainers.image.base.image="mcr.microsoft.com/devcontainers/base:ubuntu-22.04"
24-
2512
COPY .tool-versions.asdf ${SCRIPTS_DIR}/${CONTAINER_NAME}/.tool-versions.asdf
26-
COPY --chmod=755 scripts ${SCRIPTS_DIR}/${CONTAINER_NAME}
13+
COPY --chmod=755 scripts/root_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/root_install.sh
14+
COPY --chmod=755 makefiles ${SCRIPTS_DIR}/makefiles
2715

2816
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
2917
RUN ./root_install.sh
3018

19+
COPY --chmod=755 scripts/vscode_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/vscode_install.sh
3120
USER vscode
3221
COPY --chown=vscode:vscode .tool-versions.asdf /home/vscode/.tool-versions.asdf
3322
COPY --chown=vscode:vscode .tool-versions /home/vscode/.tool-versions
3423

35-
ENV PATH="/home/vscode/.asdf/shims/:$PATH"
24+
ENV PATH="/home/vscode/.asdf/shims/:/home/vscode/.guard/bin/:$PATH"
3625
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
3726
RUN ./vscode_install.sh
3827

3928
# Switch back to root to install the devcontainer CLI globally
4029
USER root
30+
31+
ENV IMAGE_TAG=${IMAGE_TAG}
32+
33+
LABEL org.opencontainers.image.source=https://github.com/NHSDigital/eps-devcontainers
34+
LABEL org.opencontainers.image.description="EPS devcontainer ${CONTAINER_NAME}:${IMAGE_TAG}"
35+
LABEL org.opencontainers.image.licenses=MIT
36+
LABEL org.opencontainers.image.containerName=${CONTAINER_NAME}
37+
LABEL org.opencontainers.image.authors="NHS England EPS Team"
38+
LABEL org.opencontainers.image.base.image="mcr.microsoft.com/devcontainers/base:ubuntu-22.04"

‎src/base/.devcontainer/makefiles/build.mk‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
.PHONY: install install-node docker-build compile
2+
install:
3+
echo "Not implemented"
4+
exit 1
5+
6+
install-node:
7+
echo "Not implemented"
8+
exit 1
9+
10+
docker-build:
11+
echo "Not implemented"
12+
exit 1
13+
14+
compile:
15+
echo "Not implemented"
16+
exit 1

‎src/base/.devcontainer/makefiles/check.mk‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
.PHONY: lint test shellcheck cfn-lint cdk-synth cfn-guard-sam-templates cfn-guard-cloudformation cfn-guard-cdk cfn-guard-terraform
2+
lint:
3+
echo "Not implemented"
4+
exit 1
5+
6+
test:
7+
echo "Not implemented"
8+
exit 1
9+
10+
shellcheck:
11+
@if find .github/scripts -maxdepth 1 -type f -name "*.sh" | grep -q .; then \
12+
shellcheck .github/scripts/*.sh; \
13+
fi
14+
@if find scripts -maxdepth 1 -type f -name "*.sh" | grep -q .; then \
15+
shellcheck scripts/*.sh; \
16+
fi
17+
18+
cfn-lint:
19+
cfn-lint -I "cloudformation/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
20+
cfn-lint -I "SAMtemplates/**/*.y*ml" 2>&1 | awk '/Run scan/ { print } /^[EW][0-9]/ { print; getline; print }'
21+
22+
cdk-synth:
23+
echo "Not implemented"
24+
exit 1
25+
26+
cfn-guard-sam-templates:
27+
@bash -eu -o pipefail -c '\
28+
rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar"); \
29+
mkdir -p .cfn_guard_out; \
30+
for ruleset in "$${rulesets[@]}"; do \
31+
while IFS= read -r -d "" file; do \
32+
SAM_OUTPUT=$$(sam validate -t "$$file" --region eu-west-2 --debug 2>&1 | grep -Pazo "(?s)AWSTemplateFormatVersion.*\\n/" | tr -d "\\0"); \
33+
output_file=".cfn_guard_out/$${file}_$${ruleset}.txt"; \
34+
mkdir -p "$$(dirname "$$output_file")"; \
35+
echo "$${SAM_OUTPUT::-1}" | ~/.guard/bin/cfn-guard validate --rules "/usr/local/share/eps/cfnguard_rulesets/output/$$ruleset.guard" --show-summary fail > "$$output_file"; \
36+
done < <(find ./SAMtemplates -type f \( -name "*.yaml" -o -name "*.yml" \) -print0); \
37+
done\
38+
'
39+
40+
cfn-guard-cloudformation:
41+
@bash -eu -o pipefail -c '\
42+
rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar"); \
43+
mkdir -p .cfn_guard_out; \
44+
for ruleset in "$${rulesets[@]}"; do \
45+
~/.guard/bin/cfn-guard validate \
46+
--data cloudformation \
47+
--rules "/tmp/ruleset/output/$$ruleset.guard" \
48+
--show-summary fail \
49+
> ".cfn_guard_out/cloudformation_$$ruleset.txt"; \
50+
done\
51+
'
52+
53+
cfn-guard-cdk:
54+
@bash -eu -o pipefail -c '\
55+
rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar"); \
56+
mkdir -p .cfn_guard_out; \
57+
for ruleset in "$${rulesets[@]}"; do \
58+
~/.guard/bin/cfn-guard validate \
59+
--data cdk.out \
60+
--rules "/tmp/ruleset/output/$$ruleset.guard" \
61+
--show-summary fail \
62+
> ".cfn_guard_out/cdk_$$ruleset.txt"; \
63+
done\
64+
'
65+
66+
cfn-guard-terraform:
67+
@bash -eu -o pipefail -c '\
68+
rulesets=("ncsc" "ncsc-cafv3" "wa-Reliability-Pillar" "wa-Security-Pillar"); \
69+
mkdir -p .cfn_guard_out; \
70+
for ruleset in "$${rulesets[@]}"; do \
71+
~/.guard/bin/cfn-guard validate \
72+
--data terraform_plans \
73+
--rules "/tmp/ruleset/output/$$ruleset.guard" \
74+
--show-summary fail \
75+
> ".cfn_guard_out/terraform_$$ruleset.txt"; \
76+
done\
77+
'

‎src/base/.devcontainer/makefiles/common.mk‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
include build.mk
2+
include check.mk
3+
include trivy.mk

‎src/base/.devcontainer/makefiles/trivy.mk‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
.PHONY: trivy-license-check trivy-generate-sbom trivy-scan-python trivy-scan-node trivy-scan-go trivy-scan-java
2+
3+
trivy-license-check:
4+
mkdir -p .trivy_out/
5+
@if [ -f poetry.lock ]; then \
6+
poetry self add poetry-plugin-export; \
7+
poetry export -f requirements.txt --with dev --without-hashes --output=requirements.txt; \
8+
fi
9+
@if [ -f src/go.sum ]; then \
10+
cd src && go mod vendor; \
11+
fi
12+
VIRTUAL_ENV=./.venv/ trivy fs . \
13+
--scanners license \
14+
--severity HIGH,CRITICAL \
15+
--config trivy.yaml \
16+
--include-dev-deps \
17+
--pkg-types library \
18+
--exit-code 1 \
19+
--output .trivy_out/license_scan.txt \
20+
--format table
21+
@if [ -f poetry.lock ]; then rm -f requirements.txt; fi
22+
@if [ -f src/go.sum ]; then rm -rf src/vendor; fi
23+
24+
trivy-generate-sbom:
25+
mkdir -p .trivy_out/
26+
trivy fs . \
27+
--scanners vuln \
28+
--config trivy.yaml \
29+
--include-dev-deps \
30+
--exit-code 0 \
31+
--output .trivy_out/sbom.cdx.json \
32+
--format cyclonedx
33+
34+
trivy-scan-python:
35+
mkdir -p .trivy_out/
36+
trivy fs . \
37+
--scanners vuln \
38+
--severity HIGH,CRITICAL \
39+
--config trivy.yaml \
40+
--include-dev-deps \
41+
--exit-code 1 \
42+
--skip-files "**/package-lock.json,**/go.mod,**/pom.xml" \
43+
--output .trivy_out/dependency_results_python.txt \
44+
--format table
45+
46+
trivy-scan-node:
47+
mkdir -p .trivy_out/
48+
trivy fs . \
49+
--scanners vuln \
50+
--severity HIGH,CRITICAL \
51+
--config trivy.yaml \
52+
--include-dev-deps \
53+
--exit-code 1 \
54+
--skip-files "**/poetry.lock,**/go.mod,**/pom.xml" \
55+
--output .trivy_out/dependency_results_node.txt \
56+
--format table
57+
58+
trivy-scan-go:
59+
mkdir -p .trivy_out/
60+
trivy fs . \
61+
--scanners vuln \
62+
--severity HIGH,CRITICAL \
63+
--config trivy.yaml \
64+
--include-dev-deps \
65+
--exit-code 1 \
66+
--skip-files "**/poetry.lock,**/package-lock.json,**/pom.xml" \
67+
--output .trivy_out/dependency_results_go.txt \
68+
--format table
69+
70+
trivy-scan-java:
71+
mkdir -p .trivy_out/
72+
trivy fs . \
73+
--scanners vuln \
74+
--severity HIGH,CRITICAL \
75+
--config trivy.yaml \
76+
--include-dev-deps \
77+
--exit-code 1 \
78+
--skip-files "**/poetry.lock,**/package-lock.json,**/go.mod" \
79+
--output .trivy_out/dependency_results_java.txt \
80+
--format table
81+
82+
trivy-scan-docker:
83+
mkdir -p .trivy_out/
84+
trivy image $${DOCKER_IMAGE} \
85+
--scanners vuln \
86+
--severity HIGH,CRITICAL \
87+
--config trivy.yaml \
88+
--include-dev-deps \
89+
--exit-code 1 \
90+
--pkg-types os,library \
91+
--output .trivy_out/dependency_results_docker.txt \
92+
--format table

‎src/base/.devcontainer/scripts/root_install.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,11 @@ mkdir -p /usr/share/secrets-scanner
6767
chmod 755 /usr/share/secrets-scanner
6868
curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o /usr/share/secrets-scanner/nhsd-rules-deny.txt
6969

70+
# get cfn-guard ruleset
71+
wget -O /tmp/ruleset.zip https://github.com/aws-cloudformation/aws-guard-rules-registry/releases/download/1.0.2/ruleset-build-v1.0.2.zip >/dev/null 2>&1
72+
mkdir -p "${SCRIPTS_DIR}/cfnguard_rulesets"
73+
unzip /tmp/ruleset.zip -d "${SCRIPTS_DIR}/cfnguard_rulesets" >/dev/null 2>&1
74+
7075
# fix user and group ids for vscode user to be 1001 so it can be used by github actions
7176
requested_uid=1001
7277
requested_gid=1001

‎src/base/.devcontainer/scripts/vscode_install.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ asdf plugin add terraform https://github.com/asdf-community/asdf-hashicorp.git
2121
asdf plugin add trivy https://github.com/zufardhiyaulhaq/asdf-trivy.git
2222
asdf plugin add yq https://github.com/sudermanjr/asdf-yq.git
2323

24+
# install cfn-guard
25+
$ curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/aws-cloudformation/cloudformation-guard/main/install-guard.sh | sh
26+
2427
# install base asdf versions of common tools
2528
cd /home/vscode
2629
asdf install

‎src/common/Dockerfile‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,15 @@ ARG BASE_VERSION_TAG
1212
ARG IMAGE_TAG
1313
ARG TARGETARCH
1414

15-
ENV BASE_IMAGE=${BASE_IMAGE}
1615
ENV SCRIPTS_DIR=${SCRIPTS_DIR}
17-
ENV CONTAINER_NAME=${CONTAINER_NAME}
18-
ENV MULTI_ARCH_TAG=${MULTI_ARCH_TAG}
19-
ENV BASE_VERSION_TAG=${BASE_VERSION_TAG}
20-
ENV IMAGE_TAG=${IMAGE_TAG}
2116
ENV TARGETARCH=${TARGETARCH}
2217

23-
LABEL org.opencontainers.image.description="EPS devcontainer ${CONTAINER_NAME}:${IMAGE_TAG}"
24-
LABEL org.opencontainers.image.version=${IMAGE_TAG}
25-
LABEL org.opencontainers.image.base.name=${BASE_IMAGE}
26-
LABEL org.opencontainers.image.containerName=${CONTAINER_NAME}
27-
2818
USER root
29-
COPY --chmod=755 scripts ${SCRIPTS_DIR}/${CONTAINER_NAME}
19+
COPY --chmod=755 scripts/root_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/root_install.sh
3020
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
3121
RUN ./root_install.sh
3222

23+
COPY --chmod=755 scripts/vscode_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/vscode_install.sh
3324
USER vscode
3425

3526
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
@@ -40,3 +31,14 @@ RUN ./vscode_install.sh
4031

4132
# Switch back to root to install the devcontainer CLI globally
4233
USER root
34+
35+
ENV CONTAINER_NAME=${CONTAINER_NAME}
36+
ENV MULTI_ARCH_TAG=${MULTI_ARCH_TAG}
37+
ENV BASE_VERSION_TAG=${BASE_VERSION_TAG}
38+
ENV IMAGE_TAG=${IMAGE_TAG}
39+
ENV BASE_IMAGE=${BASE_IMAGE}
40+
41+
LABEL org.opencontainers.image.description="EPS devcontainer ${CONTAINER_NAME}:${IMAGE_TAG}"
42+
LABEL org.opencontainers.image.version=${IMAGE_TAG}
43+
LABEL org.opencontainers.image.base.name=${BASE_IMAGE}
44+
LABEL org.opencontainers.image.containerName=${CONTAINER_NAME}

‎src/languages/node_24_python_3_12/.devcontainer/scripts/vscode_install.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,6 @@ asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git
77

88
asdf install python
99
asdf install
10+
11+
# install cfn-lint
12+
pip install --user cfn-lint

0 commit comments

Comments
 (0)