Skip to content

Commit 25fb477

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-0000] - Use common dev container (#65)
## Summary - Routine Change ### Details - use common dev container
1 parent 5b673ad commit 25fb477

File tree

11 files changed

+178
-212
lines changed

11 files changed

+178
-212
lines changed

.tool-versions renamed to .devcontainer/.tool-versions.bootstrap

File renamed without changes.

‎.devcontainer/Dockerfile‎

Lines changed: 14 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -1,110 +1,14 @@
1-
FROM alpine:3.23.3 AS build
2-
ARG TARGETARCH
3-
RUN apk add --no-cache cosign bash curl jq
4-
COPY src/base/.devcontainer/scripts/install_trivy.sh /tmp/install_trivy.sh
5-
RUN case "${TARGETARCH}" in \
6-
x86_64|amd64) TRIVY_ARCH=64bit ;; \
7-
aarch64|arm64) TRIVY_ARCH=ARM64 ;; \
8-
*) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
9-
esac \
10-
&& INSTALL_DIR=/tmp/trivy/ ARCH="${TRIVY_ARCH}" /tmp/install_trivy.sh
11-
12-
13-
FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
14-
ARG TARGETARCH
15-
ENV TARGETARCH=${TARGETARCH}
16-
17-
# Install essential packages first
18-
RUN apt-get update && apt-get install -y \
19-
curl \
20-
wget \
21-
git \
22-
sudo \
23-
unzip \
24-
&& apt-get clean \
25-
&& rm -rf /var/lib/apt/lists/*
26-
27-
# Copy ASDF version file
28-
ARG ASDF_VERSION
29-
COPY .tool-versions.asdf /tmp/.tool-versions.asdf
30-
31-
# Add amd64 architecture if on arm64
32-
RUN if [ "$TARGETARCH" == "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then dpkg --add-architecture amd64; fi
33-
34-
RUN apt-get update \
35-
&& export DEBIAN_FRONTEND=noninteractive \
36-
&& apt-get -y dist-upgrade \
37-
&& apt-get -y install --no-install-recommends htop vim curl git build-essential \
38-
libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev libbz2-dev \
39-
zlib1g-dev unixodbc unixodbc-dev libsecret-1-0 libsecret-1-dev libsqlite3-dev \
40-
jq apt-transport-https ca-certificates gnupg-agent \
41-
software-properties-common bash-completion python3-pip make libbz2-dev \
42-
libreadline-dev libsqlite3-dev wget llvm libncurses5-dev libncursesw5-dev \
43-
xz-utils tk-dev liblzma-dev netcat-traditional libyaml-dev uuid-runtime xxd unzip
44-
45-
# install aws stuff
46-
# Download correct AWS CLI for arch
47-
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
48-
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip"; \
49-
else \
50-
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"; \
51-
fi && \
52-
unzip /tmp/awscliv2.zip -d /tmp/aws-cli && \
53-
/tmp/aws-cli/aws/install && \
54-
rm /tmp/awscliv2.zip && rm -rf /tmp/aws-cli
55-
56-
# Install ASDF
57-
RUN ASDF_VERSION=$(awk '!/^#/ && NF {print $1; exit}' /tmp/.tool-versions.asdf) && \
58-
if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
59-
wget -O /tmp/asdf.tar.gz "https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-arm64.tar.gz"; \
60-
else \
61-
wget -O /tmp/asdf.tar.gz "https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-amd64.tar.gz"; \
62-
fi && \
63-
tar -xzf /tmp/asdf.tar.gz -C /tmp && \
64-
mkdir -p /usr/bin && \
65-
mv /tmp/asdf /usr/bin/asdf && \
66-
chmod +x /usr/bin/asdf && \
67-
rm -rf /tmp/asdf.tar.gz
68-
69-
# install gitsecrets
70-
RUN git clone https://github.com/awslabs/git-secrets.git /tmp/git-secrets && \
71-
cd /tmp/git-secrets && \
72-
make install && \
73-
cd && \
74-
rm -rf /tmp/git-secrets && \
75-
mkdir -p /usr/share/secrets-scanner && \
76-
chmod 755 /usr/share/secrets-scanner && \
77-
curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o /usr/share/secrets-scanner/nhsd-rules-deny.txt
78-
79-
COPY --from=build /tmp/trivy/trivy /usr/local/bin/trivy
80-
81-
USER vscode
82-
83-
ENV PATH="/home/vscode/.asdf/shims:/home/vscode/.local/bin:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"
84-
RUN \
85-
echo 'PATH="/home/vscode/.asdf/shims:/home/vscode/.local/bin:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"' >> ~/.bashrc; \
86-
echo '. <(asdf completion bash)' >> ~/.bashrc; \
87-
echo '# Install Ruby Gems to ~/gems' >> ~/.bashrc; \
88-
echo 'export GEM_HOME="$HOME/gems"' >> ~/.bashrc; \
89-
echo 'export PATH="$HOME/gems/bin:$PATH"' >> ~/.bashrc;
90-
91-
# Install ASDF plugins
92-
RUN asdf plugin add python; \
93-
asdf plugin add poetry https://github.com/asdf-community/asdf-poetry.git; \
94-
asdf plugin add shellcheck https://github.com/luizm/asdf-shellcheck.git; \
95-
asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git; \
96-
asdf plugin add direnv; \
97-
asdf plugin add actionlint; \
98-
asdf plugin add ruby https://github.com/asdf-vm/asdf-ruby.git; \
99-
asdf plugin add yq https://github.com/sudermanjr/asdf-yq.git;
100-
101-
WORKDIR /workspaces/eps-devcontainers
102-
COPY .tool-versions /workspaces/eps-devcontainers/.tool-versions
103-
COPY .tool-versions /home/vscode/.tool-versions
104-
105-
# install python before poetry to ensure correct python version is used
106-
RUN asdf install python; \
107-
asdf install
108-
109-
RUN git-secrets --register-aws --global && \
110-
git-secrets --add-provider --global -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt
1+
ARG IMAGE_NAME=regression_tests
2+
ARG IMAGE_VERSION=latest
3+
FROM ghcr.io/nhsdigital/eps-devcontainers/${IMAGE_NAME}:${IMAGE_VERSION}
4+
5+
USER root
6+
# specify DOCKER_GID to force container docker group id to match host
7+
RUN if [ -n "${DOCKER_GID}" ]; then \
8+
if ! getent group docker; then \
9+
groupadd -g ${DOCKER_GID} docker; \
10+
else \
11+
groupmod -g ${DOCKER_GID} docker; \
12+
fi && \
13+
usermod -aG docker vscode; \
14+
fi

‎.devcontainer/Dockerfile.bootstrap‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# This can be used to bootstrap devcontainer when no images have been pushed
2+
FROM alpine:3.23.3 AS build
3+
ARG TARGETARCH
4+
RUN apk add --no-cache cosign bash curl jq
5+
COPY src/base/.devcontainer/scripts/install_trivy.sh /tmp/install_trivy.sh
6+
RUN case "${TARGETARCH}" in \
7+
x86_64|amd64) TRIVY_ARCH=64bit ;; \
8+
aarch64|arm64) TRIVY_ARCH=ARM64 ;; \
9+
*) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
10+
esac \
11+
&& INSTALL_DIR=/tmp/trivy/ ARCH="${TRIVY_ARCH}" /tmp/install_trivy.sh
12+
13+
14+
FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
15+
ARG TARGETARCH
16+
ENV TARGETARCH=${TARGETARCH}
17+
18+
# Install essential packages first
19+
RUN apt-get update && apt-get install -y \
20+
curl \
21+
wget \
22+
git \
23+
sudo \
24+
unzip \
25+
&& apt-get clean \
26+
&& rm -rf /var/lib/apt/lists/*
27+
28+
# Copy ASDF version file
29+
ENV ASDF_VERSION=0.18.1
30+
31+
# Add amd64 architecture if on arm64
32+
RUN if [ "$TARGETARCH" == "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then dpkg --add-architecture amd64; fi
33+
34+
RUN apt-get update \
35+
&& export DEBIAN_FRONTEND=noninteractive \
36+
&& apt-get -y dist-upgrade \
37+
&& apt-get -y install --no-install-recommends htop vim curl git build-essential \
38+
libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev libbz2-dev \
39+
zlib1g-dev unixodbc unixodbc-dev libsecret-1-0 libsecret-1-dev libsqlite3-dev \
40+
jq apt-transport-https ca-certificates gnupg-agent \
41+
software-properties-common bash-completion python3-pip make libbz2-dev \
42+
libreadline-dev libsqlite3-dev wget llvm libncurses5-dev libncursesw5-dev \
43+
xz-utils tk-dev liblzma-dev netcat-traditional libyaml-dev uuid-runtime xxd unzip
44+
45+
# install aws stuff
46+
# Download correct AWS CLI for arch
47+
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
48+
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip"; \
49+
else \
50+
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"; \
51+
fi && \
52+
unzip /tmp/awscliv2.zip -d /tmp/aws-cli && \
53+
/tmp/aws-cli/aws/install && \
54+
rm /tmp/awscliv2.zip && rm -rf /tmp/aws-cli
55+
56+
# Install ASDF
57+
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
58+
wget -O /tmp/asdf.tar.gz "https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-arm64.tar.gz"; \
59+
else \
60+
wget -O /tmp/asdf.tar.gz "https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-amd64.tar.gz"; \
61+
fi && \
62+
tar -xzf /tmp/asdf.tar.gz -C /tmp && \
63+
mkdir -p /usr/bin && \
64+
mv /tmp/asdf /usr/bin/asdf && \
65+
chmod +x /usr/bin/asdf && \
66+
rm -rf /tmp/asdf.tar.gz
67+
68+
# install gitsecrets
69+
RUN git clone https://github.com/awslabs/git-secrets.git /tmp/git-secrets && \
70+
cd /tmp/git-secrets && \
71+
make install && \
72+
cd && \
73+
rm -rf /tmp/git-secrets && \
74+
mkdir -p /usr/share/secrets-scanner && \
75+
chmod 755 /usr/share/secrets-scanner && \
76+
curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o /usr/share/secrets-scanner/nhsd-rules-deny.txt
77+
78+
COPY --from=build /tmp/trivy/trivy /usr/local/bin/trivy
79+
80+
USER vscode
81+
82+
ENV PATH="/home/vscode/.asdf/shims:/home/vscode/.local/bin:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"
83+
RUN \
84+
echo 'PATH="/home/vscode/.asdf/shims:/home/vscode/.local/bin:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"' >> ~/.bashrc; \
85+
echo '. <(asdf completion bash)' >> ~/.bashrc; \
86+
echo '# Install Ruby Gems to ~/gems' >> ~/.bashrc; \
87+
echo 'export GEM_HOME="$HOME/gems"' >> ~/.bashrc; \
88+
echo 'export PATH="$HOME/gems/bin:$PATH"' >> ~/.bashrc;
89+
90+
# Install ASDF plugins
91+
RUN asdf plugin add python; \
92+
asdf plugin add poetry https://github.com/asdf-community/asdf-poetry.git; \
93+
asdf plugin add shellcheck https://github.com/luizm/asdf-shellcheck.git; \
94+
asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git; \
95+
asdf plugin add direnv; \
96+
asdf plugin add actionlint; \
97+
asdf plugin add ruby https://github.com/asdf-vm/asdf-ruby.git; \
98+
asdf plugin add yq https://github.com/sudermanjr/asdf-yq.git;
99+
100+
WORKDIR /workspaces/eps-devcontainers
101+
COPY .devcontainer/.tool-versions.bootstrap /workspaces/eps-devcontainers/.tool-versions
102+
COPY .devcontainer/.tool-versions.bootstrap /home/vscode/.tool-versions
103+
104+
# install python before poetry to ensure correct python version is used
105+
RUN asdf install python; \
106+
asdf install
107+
108+
RUN git-secrets --register-aws --global && \
109+
git-secrets --add-provider --global -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt

‎.devcontainer/devcontainer.json‎

Lines changed: 13 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
1-
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
2-
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
31
{
42
"name": "eps-devcontainers",
5-
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
63
"build": {
74
"dockerfile": "Dockerfile",
85
"context": "..",
9-
"args": {}
6+
"args": {
7+
"DOCKER_GID": "${env:DOCKER_GID:}",
8+
"IMAGE_NAME": "node_24_python_3_14",
9+
"IMAGE_VERSION": "latest",
10+
"USER_UID": "${localEnv:USER_ID:}",
11+
"USER_GID": "${localEnv:GROUP_ID:}"
12+
}
1013
},
1114
"mounts": [
1215
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
@@ -19,14 +22,8 @@
1922
"--network=host"
2023
],
2124
"remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" },
22-
"postAttachCommand": "docker build -f https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/tags/v4.0.4/dockerfiles/nhsd-git-secrets.dockerfile -t git-secrets . && poetry run pre-commit install --install-hooks -f",
25+
"postAttachCommand": "git-secrets --register-aws; git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt",
2326
"features": {
24-
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
25-
"version": "latest",
26-
"moby": "true",
27-
"installDockerBuildx": "true"
28-
},
29-
"ghcr.io/devcontainers/features/github-cli:1": {}
3027
},
3128
"customizations": {
3229
"vscode": {
@@ -60,10 +57,10 @@
6057
"python.testing.pytestEnabled": true,
6158
"pylint.enabled": false,
6259
"python.linting.flake8Enabled": true,
63-
"python.linting.enabled": true, // required to format on save
64-
"editor.formatOnPaste": false, // required
65-
"editor.formatOnType": false, // required
66-
"editor.formatOnSave": true, // optional
60+
"python.linting.enabled": true,
61+
"editor.formatOnPaste": false,
62+
"editor.formatOnType": false,
63+
"editor.formatOnSave": true,
6764
"editor.formatOnSaveMode": "file",
6865
"cSpell.words": ["fhir", "Formik", "pino", "serialisation"],
6966
"editor.defaultFormatter": "dbaeumer.vscode-eslint"
@@ -72,16 +69,6 @@
7269
"eslint.useFlatConfig": true,
7370
"eslint.format.enable": true
7471
}
75-
},
76-
"postCreateCommand": "rm -f ~/.docker/config.json; git config --global --add safe.directory /workspaces/eps-devcontainers; make install; direnv allow ."
77-
// "features": {},
78-
// Use 'forwardPorts' to make a list of ports inside the container available locally.
79-
// "forwardPorts": [],
80-
// Use 'postCreateCommand' to run commands after the container is created.
81-
// "postCreateCommand": ""
82-
// Configure tool-specific properties.
83-
// "customizations": {},
84-
// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
85-
// "remoteUser": "root"
72+
}
8673
}
8774

‎.github/workflows/build_multi_arch_image.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
- name: setup node
7474
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
7575
with:
76-
node-version-file: .tool-versions
76+
node-version: '24.14.0'
7777

7878
- name: make install
7979
run: |

‎.github/workflows/ci.yml‎

Lines changed: 14 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,40 +4,29 @@ on:
44
branches: [main]
55

66
jobs:
7-
get_asdf_version:
8-
runs-on: ubuntu-22.04
9-
outputs:
10-
asdf_version: '${{ steps.asdf-version.outputs.version }}'
11-
tag_format: '${{ steps.load-config.outputs.TAG_FORMAT }}'
12-
steps:
13-
- name: Checkout code
14-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
15-
- name: Get asdf version
16-
id: asdf-version
17-
run: >-
18-
echo "version=$(awk '!/^#/ && NF {print $1; exit}'
19-
.tool-versions.asdf)" >> "$GITHUB_OUTPUT"
20-
- name: Load config value
21-
id: load-config
22-
run: |
23-
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
24-
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
7+
get_config_values:
8+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@5ac2707dd9cd60ad127275179495b9c890d74711
9+
with:
10+
verify_published_from_main_image: true
2511
quality_checks:
26-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@5ac2707dd9cd60ad127275179495b9c890d74711
12+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
2713
needs:
28-
- get_asdf_version
14+
- get_config_values
2915
with:
30-
asdfVersion: '${{ needs.get_asdf_version.outputs.asdf_version }}'
16+
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
3117
secrets:
3218
SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}'
3319
tag_release:
34-
needs: [quality_checks, get_asdf_version]
35-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release.yml@5ac2707dd9cd60ad127275179495b9c890d74711
20+
needs: [quality_checks, get_config_values]
21+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
22+
permissions:
23+
id-token: write
24+
contents: write
3625
with:
3726
dry_run: true
38-
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
27+
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
3928
branch_name: main
40-
tag_format: ${{ needs.get_asdf_version.outputs.tag_format }}
29+
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
4130
secrets: inherit
4231
build_all_images:
4332
needs:

0 commit comments

Comments
 (0)