Skip to content

Commit 598b505

Browse files
JackSpagnoliNHSJackSpagnoliNHS
authored
New: [AEA-6316] - Adds EPS Storage Terraform Project Image (#31)
## Summary - Routine Change - ✨ New Feature ### Details Adds EPS Storage Terraform Project Image
1 parent 6cb248a commit 598b505

11 files changed

Lines changed: 219 additions & 30 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ node_modules/
33
src/base/.devcontainer/language_versions/
44
.trivyignore_combined.yaml
55
.out/
6+
.envrc

‎README.md‎

Lines changed: 10 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,9 @@ USER root
6262
# specify DOCKER_GID to force container docker group id to match host
6363
RUN if [ -n "${DOCKER_GID}" ]; then \
6464
if ! getent group docker; then \
65-
groupadd -g ${DOCKER_GID} docker; \
65+
groupadd -g "${DOCKER_GID}" docker; \
6666
else \
67-
groupmod -g ${DOCKER_GID} docker; \
67+
groupmod -g "${DOCKER_GID}" docker; \
6868
fi && \
6969
usermod -aG docker vscode; \
7070
fi
@@ -108,40 +108,26 @@ IMAGE_NAME and IMAGE_VERSION should be changed as appropriate.
108108
You should not need to add any features as these are already baked into the image
109109

110110
## Getting image name and version in GitHub Actions
111-
This job should be used in GitHub Actions wherever you need to get the dev container name or tag
111+
This shared workflow should be used in GitHub Actions wherever you need to get the dev container name or tag.
112+
113+
verify_published_from_main_image should be set to false for testing pull request images.
112114

113115
```
114116
get_config_values:
115-
runs-on: ubuntu-22.04
116-
outputs:
117-
devcontainer_image_name: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE_NAME }}
118-
devcontainer_image_version: ${{ steps.load-config.outputs.DEVCONTAINER_VERSION }}
119-
steps:
120-
- name: Checkout code
121-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
122-
- name: Load config value
123-
id: load-config
124-
run: |
125-
DEVCONTAINER_IMAGE_NAME=$(jq -r '.build.args.IMAGE_NAME' .devcontainer/devcontainer.json)
126-
DEVCONTAINER_IMAGE_VERSION=$(jq -r '.build.args.IMAGE_VERSION' .devcontainer/devcontainer.json)
127-
echo "DEVCONTAINER_IMAGE_NAME=$DEVCONTAINER_IMAGE_NAME" >> "$GITHUB_OUTPUT"
128-
echo "DEVCONTAINER_IMAGE_VERSION=$DEVCONTAINER_VERSION" >> "$GITHUB_OUTPUT"
117+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@8404cf6e3a61ac8de4d1644e175e288aa4965815
118+
with:
119+
verify_published_from_main_image: false
129120
```
130121
## Using images in GitHub Actions
131122
To use the image in GitHub Actions, you should first verify the attestation of the image and reference the image by the digest
132123
For CI and release pipelines, you should set verify_published_from_main_image to ensure that only images published from main are used.
133124
```
134125
jobs:
135-
verify_attestation:
136-
uses: NHSDigital/eps-common-workflows/.github/workflows/verify-attestation.yml@<latest published version>
137-
with:
138-
runtime_docker_image: "${{ inputs.runtime_docker_image }}"
139-
verify_published_from_main_image: false
140126
my_job_name:
141127
runs-on: ubuntu-22.04
142-
needs: verify_attestation
128+
needs: get_config_values
143129
container:
144-
image: ${{ needs.verify_attestation.outputs.pinned_image }}
130+
image: ${{ needs.get_config_values.outputs.pinned_image }}
145131
options: --user 1001:1001 --group-add 128
146132
defaults:
147133
run:
@@ -153,7 +139,6 @@ jobs:
153139
... other steps ....
154140
```
155141
It is important that:
156-
- the image specified uses the tag starting githubactions-
157142
- there is `options: --user 1001:1001 --group-add 128` below image to ensure it uses the correct user id and is added to the docker group
158143
- the default shell is set to be bash
159144
- the first step copies .tool-versions from /home/vscode to $HOME/.tool-versions

‎src/common/.trivyignore.yaml‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,44 @@ vulnerabilities:
22
- id: CVE-2024-35870
33
statement: "kernel: smb: client: fix UAF in smb2_reconnect_server()"
44
purls:
5-
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-170.180?arch=amd64&distro=ubuntu-22.04"
5+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=amd64&distro=ubuntu-22.04"
6+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=arm64&distro=ubuntu-22.04"
67
expired_at: 2026-08-12
78
- id: CVE-2024-53179
89
statement: "kernel: smb: client: fix use-after-free of signing key"
910
purls:
10-
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-170.180?arch=amd64&distro=ubuntu-22.04"
11+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=amd64&distro=ubuntu-22.04"
12+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=arm64&distro=ubuntu-22.04"
1113
expired_at: 2026-08-12
1214
- id: CVE-2025-37849
1315
statement: "kernel: KVM: arm64: Tear down vGIC on failed vCPU creation"
1416
purls:
15-
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-170.180?arch=amd64&distro=ubuntu-22.04"
17+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=amd64&distro=ubuntu-22.04"
18+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=arm64&distro=ubuntu-22.04"
1619
expired_at: 2026-08-12
1720
- id: CVE-2025-37899
1821
statement: "kernel: ksmbd: fix use-after-free in session logoff"
1922
purls:
20-
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-170.180?arch=amd64&distro=ubuntu-22.04"
23+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=amd64&distro=ubuntu-22.04"
24+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=arm64&distro=ubuntu-22.04"
2125
expired_at: 2026-08-12
2226
- id: CVE-2025-38118
2327
statement: "kernel: Linux kernel: Bluetooth MGMT use-after-free vulnerability allows privilege escalation"
2428
purls:
25-
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-170.180?arch=amd64&distro=ubuntu-22.04"
29+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=amd64&distro=ubuntu-22.04"
30+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=arm64&distro=ubuntu-22.04"
2631
expired_at: 2026-08-12
32+
- id: CVE-2026-23111
33+
statement: "kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check"
34+
purls:
35+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=amd64&distro=ubuntu-22.04"
36+
- "pkg:deb/ubuntu/linux-libc-dev@5.15.0-171.181?arch=arm64&distro=ubuntu-22.04"
37+
expired_at: 2026-08-26
38+
- id: CVE-2025-61594
39+
statement: "uri: URI module: Credential exposure via URI + operator"
40+
purls:
41+
- "pkg:gem/uri@0.13.0"
42+
expired_at: 2026-08-26
2743
- id: CVE-2026-26007
2844
statement: "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves"
2945
purls:

‎src/projects/eps-storage-terraform/.devcontainer/.tool-versions‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
terraform 1.14.2

‎src/projects/eps-storage-terraform/.devcontainer/Dockerfile‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
ARG BASE_VERSION_TAG=latest
2+
ARG BASE_IMAGE=ghcr.io/nhsdigital/eps-devcontainers/node_24_python_3_13:${BASE_VERSION_TAG}
3+
4+
FROM ${BASE_IMAGE}
5+
6+
ARG SCRIPTS_DIR=/usr/local/share/eps
7+
ARG CONTAINER_NAME
8+
ARG MULTI_ARCH_TAG
9+
ARG BASE_VERSION_TAG
10+
ARG IMAGE_TAG
11+
ARG TARGETARCH
12+
13+
ENV SCRIPTS_DIR=${SCRIPTS_DIR}
14+
ENV CONTAINER_NAME=${CONTAINER_NAME}
15+
ENV MULTI_ARCH_TAG=${MULTI_ARCH_TAG}
16+
ENV BASE_VERSION_TAG=${BASE_VERSION_TAG}
17+
ENV IMAGE_TAG=${IMAGE_TAG}
18+
ENV TARGETARCH=${TARGETARCH}
19+
20+
LABEL org.opencontainers.image.description="EPS devcontainer ${CONTAINER_NAME}:${IMAGE_TAG}"
21+
LABEL org.opencontainers.image.version=${IMAGE_TAG}
22+
LABEL org.opencontainers.image.base.name=${BASE_IMAGE}
23+
LABEL org.opencontainers.image.containerName=${CONTAINER_NAME}
24+
25+
USER root
26+
COPY --chmod=755 scripts ${SCRIPTS_DIR}/${CONTAINER_NAME}
27+
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
28+
RUN ./root_install.sh
29+
30+
USER vscode
31+
32+
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
33+
COPY .tool-versions /tmp/.tool-versions
34+
RUN cat /tmp/.tool-versions >> /home/vscode/.tool-versions
35+
36+
RUN ./vscode_install.sh
37+
38+
# Switch back to root to install the devcontainer CLI globally
39+
USER root

‎src/projects/eps-storage-terraform/.devcontainer/devcontainer.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
2+
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
3+
{
4+
"name": "EPS Devcontainer node_24 python_3.13",
5+
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
6+
"build": {
7+
"dockerfile": "Dockerfile",
8+
"args": {
9+
"CONTAINER_NAME": "eps_devcontainer_${localEnv:CONTAINER_NAME}",
10+
"MULTI_ARCH_TAG": "${localEnv:MULTI_ARCH_TAG}",
11+
"BASE_VERSION_TAG": "${localEnv:BASE_VERSION_TAG}",
12+
"IMAGE_TAG": "${localEnv:IMAGE_TAG}"
13+
},
14+
"context": "."
15+
},
16+
"features": {}
17+
}
18+

‎src/projects/eps-storage-terraform/.devcontainer/scripts/root_install.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
5+
# clean up
6+
apt-get clean
7+
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

‎src/projects/eps-storage-terraform/.devcontainer/scripts/vscode_install.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
set -e
3+
4+
# install terraform using asdf
5+
asdf plugin add terraform
6+
asdf install

‎src/projects/eps-storage-terraform/.trivyignore.yaml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
vulnerabilities:
2+
- id: CVE-2022-25235
3+
statement: "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution"
4+
purls:
5+
- "pkg:deb/ubuntu/firefox@147.0.3%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=amd64&distro=ubuntu-22.04"
6+
expired_at: 2026-08-12
7+
- id: CVE-2022-25236
8+
statement: "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution"
9+
purls:
10+
- "pkg:deb/ubuntu/firefox@147.0.3%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=amd64&distro=ubuntu-22.04"
11+
expired_at: 2026-08-12
12+
- id: CVE-2022-26485
13+
statement: "Mozilla: Use-after-free in XSLT parameter processing"
14+
purls:
15+
- "pkg:deb/ubuntu/firefox@147.0.3%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=amd64&distro=ubuntu-22.04"
16+
expired_at: 2026-08-12
17+
- id: CVE-2022-26486
18+
statement: "Mozilla: Use-after-free in WebGPU IPC Framework"
19+
purls:
20+
- "pkg:deb/ubuntu/firefox@147.0.3%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=amd64&distro=ubuntu-22.04"
21+
expired_at: 2026-08-12
22+
- id: CVE-2026-25547
23+
statement: "brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion"
24+
purls:
25+
- "pkg:npm/%40isaacs/brace-expansion@5.0.0"
26+
expired_at: 2026-08-12
27+
- id: CVE-2025-64756
28+
statement: "glob: glob: Command Injection Vulnerability via Malicious Filenames"
29+
purls:
30+
- "pkg:npm/glob@10.4.5"
31+
- "pkg:npm/glob@11.0.3"
32+
expired_at: 2026-08-12
33+
- id: CVE-2026-23745
34+
statement: "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives"
35+
purls:
36+
- "pkg:npm/tar@7.5.1"
37+
expired_at: 2026-08-12
38+
- id: CVE-2026-23950
39+
statement: "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition"
40+
purls:
41+
- "pkg:npm/tar@7.5.1"
42+
expired_at: 2026-08-12
43+
- id: CVE-2026-24842
44+
statement: "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
45+
purls:
46+
- "pkg:npm/tar@7.5.1"
47+
expired_at: 2026-08-12
48+
- id: CVE-2022-25235
49+
statement: "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution"
50+
purls:
51+
- "pkg:deb/ubuntu/firefox@147.0.3%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=arm64&distro=ubuntu-22.04"
52+
expired_at: 2026-08-13
53+
- id: CVE-2022-25236
54+
statement: "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution"
55+
purls:
56+
- "pkg:deb/ubuntu/firefox@147.0.3%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=arm64&distro=ubuntu-22.04"
57+
expired_at: 2026-08-13
58+
- id: CVE-2022-26485
59+
statement: "Mozilla: Use-after-free in XSLT parameter processing"
60+
purls:
61+
- "pkg:deb/ubuntu/firefox@147.0.3%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=arm64&distro=ubuntu-22.04"
62+
expired_at: 2026-08-13
63+
- id: CVE-2022-26486
64+
statement: "Mozilla: Use-after-free in WebGPU IPC Framework"
65+
purls:
66+
- "pkg:deb/ubuntu/firefox@147.0.3%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=arm64&distro=ubuntu-22.04"
67+
expired_at: 2026-08-13
68+
- id: CVE-2022-25235
69+
statement: "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution"
70+
purls:
71+
- "pkg:deb/ubuntu/firefox@147.0.4%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=arm64&distro=ubuntu-22.04"
72+
expired_at: 2026-08-16
73+
- id: CVE-2022-25236
74+
statement: "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution"
75+
purls:
76+
- "pkg:deb/ubuntu/firefox@147.0.4%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=arm64&distro=ubuntu-22.04"
77+
expired_at: 2026-08-16
78+
- id: CVE-2022-26485
79+
statement: "Mozilla: Use-after-free in XSLT parameter processing"
80+
purls:
81+
- "pkg:deb/ubuntu/firefox@147.0.4%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=arm64&distro=ubuntu-22.04"
82+
expired_at: 2026-08-16
83+
- id: CVE-2022-26486
84+
statement: "Mozilla: Use-after-free in WebGPU IPC Framework"
85+
purls:
86+
- "pkg:deb/ubuntu/firefox@147.0.4%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=arm64&distro=ubuntu-22.04"
87+
expired_at: 2026-08-16
88+
- id: CVE-2022-25235
89+
statement: "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution"
90+
purls:
91+
- "pkg:deb/ubuntu/firefox@147.0.4%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=amd64&distro=ubuntu-22.04"
92+
expired_at: 2026-08-16
93+
- id: CVE-2022-25236
94+
statement: "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution"
95+
purls:
96+
- "pkg:deb/ubuntu/firefox@147.0.4%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=amd64&distro=ubuntu-22.04"
97+
expired_at: 2026-08-16
98+
- id: CVE-2022-26485
99+
statement: "Mozilla: Use-after-free in XSLT parameter processing"
100+
purls:
101+
- "pkg:deb/ubuntu/firefox@147.0.4%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=amd64&distro=ubuntu-22.04"
102+
expired_at: 2026-08-16
103+
- id: CVE-2022-26486
104+
statement: "Mozilla: Use-after-free in WebGPU IPC Framework"
105+
purls:
106+
- "pkg:deb/ubuntu/firefox@147.0.4%2Bbuild1-0ubuntu0.22.04.1~mt1?arch=amd64&distro=ubuntu-22.04"
107+
expired_at: 2026-08-16

‎src/projects/eps-storage-terraform/trivy.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ignorefile: "src/projects/eps-storage-terraform/.trivyignore_combined.yaml"

0 commit comments

Comments
 (0)