Skip to content

Chore: [AEA-0000] - add tflint to eps-storage-terraform #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anthony-nhs merged 17 commits into from
Apr 15, 2026
Merged

Chore: [AEA-0000] - add tflint to eps-storage-terraform #94

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
440d220
fix build
anthony-nhs Apr 14, 2026
f5d589c
get rid of 3rd party action
anthony-nhs Apr 14, 2026
a38b6cd
Merge branch 'main' into update_storage_terraform
anthony-nhs Apr 14, 2026
a1f4631
Merge branch 'main' into update_storage_terraform
anthony-nhs Apr 15, 2026
4e9d982
less permissions
anthony-nhs Apr 15, 2026
a9193c1
fix
anthony-nhs Apr 15, 2026
636d055
fix
anthony-nhs Apr 15, 2026
0877192
fix
anthony-nhs Apr 15, 2026
4fc4b74
fix it
anthony-nhs Apr 15, 2026
55d554e
pass github token to tflint
anthony-nhs Apr 15, 2026
4098d86
latest qc
anthony-nhs Apr 15, 2026
f304a05
better names
anthony-nhs Apr 15, 2026
3306be3
multi arch tools
anthony-nhs Apr 15, 2026
567bfe2
try without cleaning space
anthony-nhs Apr 15, 2026
1c1a353
update some versions
anthony-nhs Apr 15, 2026
c46f3b2
no script
anthony-nhs Apr 15, 2026
11f14ca
do not need zizmor file
anthony-nhs Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/build_multi_arch_image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ jobs:
BASE_FOLDER: "${{ inputs.base_folder }}"
NO_CACHE: '${{ inputs.NO_CACHE }}'
BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Check docker vulnerabilities - json output
run: |
make scan-image-json
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ jobs:
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
needs:
- get_config_values
permissions:
contents: read
packages: read
id-token: write
with:
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
secrets:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/pull_request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ jobs:
- get_config_values
with:
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
permissions:
contents: read
packages: read
id-token: write
secrets:
SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}'
pr_title_format_check:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,10 @@ jobs:
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f2d4d6942115472d3f08316cd25f400b02a9dc69
needs:
- get_config_values
permissions:
contents: read
packages: read
id-token: write
with:
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
secrets:
Expand Down
11 changes: 9 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ build-node-24-python-3-14-image:
CONTAINER_NAME=node_24_python_3_14 BASE_VERSION_TAG=local-build BASE_FOLDER=languages IMAGE_TAG=local-build $(MAKE) build-image

build-eps-storage-terraform-image:
CONTAINER_NAME=eps_storage_terraform BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image
CONTAINER_NAME=eps-storage-terraform BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image

build-eps-data-extract-image:
CONTAINER_NAME=eps_data_extract BASE_VERSION_TAG=local-build BASE_FOLDER=projects IMAGE_TAG=local-build $(MAKE) build-image
Expand Down Expand Up @@ -72,7 +72,14 @@ build-grype:
build-grant:
docker build -f src/base/.devcontainer/Dockerfile.grant --tag local_grant:latest src/base/.devcontainer/

build-image: build-syft build-grype build-grant guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
build-tflint:
docker buildx build \
--secret id=GH_TOKEN,env=GITHUB_TOKEN \
-f src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint \
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This uses docker buildx build to tag local_tflint:latest, but without --load (or an explicit --output type=docker). With the common docker-container buildx driver (e.g., in GitHub Actions), the tagged image won't be loaded into the local Docker daemon, so subsequent devcontainer build steps that do FROM local_tflint:latest will fail to resolve the image. Add --load (single-platform) or change the approach to export the binary via --output and copy it in.

Suggested change
-f src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint \
-f src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint \
--load \

Copilot uses AI. Check for mistakes.
--tag local_tflint:latest \
src/projects/eps-storage-terraform/.devcontainer/

build-image: build-syft build-grype build-grant build-tflint guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

build-image now always depends on build-tflint, which introduces an extra build step (and a required GITHUB_TOKEN secret) even when building unrelated devcontainers. This can break local builds and adds avoidable CI time. Consider making build-tflint conditional (e.g., only when CONTAINER_NAME=eps-storage-terraform), or moving the tflint build into the eps-storage-terraform Dockerfile so other images don't pay the cost.

Suggested change
build-image: build-syft build-grype build-grant build-tflint guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
build-image: build-syft build-grype build-grant guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
if [ "$${CONTAINER_NAME}" = "eps_storage_terraform" ]; then \
$(MAKE) build-tflint; \
fi; \

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

build-image now always depends on build-tflint, which requires a GitHub token secret to be present and pulls/builds an extra image even when building unrelated containers (e.g., base, node_24_*). This makes local builds and CI builds for other images fail or do unnecessary work. Consider only building local_tflint when the target container actually needs it (e.g., conditionally in the eps-storage-terraform build, or by making the Dockerfile fall back when local_tflint is absent).

Suggested change
build-image: build-syft build-grype build-grant build-tflint guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
build-image: build-syft build-grype build-grant guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
if [ "$${CONTAINER_NAME}" = "eps_storage_terraform" ]; then \
$(MAKE) build-tflint; \
fi; \

Copilot uses AI. Check for mistakes.
workspace_folder="$${CONTAINER_NAME}"; \
case "$${CONTAINER_NAME}" in \
eps_*) workspace_folder="$$(printf '%s' "$${CONTAINER_NAME}" | tr '_' '-')" ;; \
Expand Down
2 changes: 2 additions & 0 deletions src/projects/eps-storage-terraform/.devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
ARG BASE_VERSION_TAG=latest
ARG BASE_IMAGE=ghcr.io/nhsdigital/eps-devcontainers/node_24_python_3_13:${BASE_VERSION_TAG}

FROM local_tflint:latest AS tflint-build
FROM ${BASE_IMAGE}

ARG SCRIPTS_DIR=/usr/local/share/eps
Expand All @@ -26,6 +27,7 @@ USER root
COPY --chmod=755 scripts ${SCRIPTS_DIR}/${CONTAINER_NAME}
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
RUN ./root_install.sh
COPY --from=tflint-build /tflint /usr/local/bin/tflint

USER vscode

Expand Down
13 changes: 13 additions & 0 deletions src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
FROM serversideup/github-cli:2.89.0 AS build
ARG TARGETARCH
ARG TFLINT_VERSION="v0.61.0"
COPY --chmod=755 scripts/install_tflint.sh /tmp/install_tflint.sh
RUN --mount=type=secret,id=GH_TOKEN,env=GH_TOKEN \
INSTALL_DIR=/tmp/tflint/ \
ARCH="${TARGETARCH}" \
VERSION="${TFLINT_VERSION}" \
Comment on lines +7 to +8
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The install script reads TARGETARCH and TFLINT_VERSION, but this RUN invocation sets ARCH and VERSION instead. As written, install_tflint.sh will exit because TARGETARCH/TFLINT_VERSION are unset, so the tflint image build will fail. Pass the expected variable names (or update the script to consume ARCH/VERSION consistently).

Suggested change
ARCH="${TARGETARCH}" \
VERSION="${TFLINT_VERSION}" \
TARGETARCH="${TARGETARCH}" \
TFLINT_VERSION="${TFLINT_VERSION}" \

Copilot uses AI. Check for mistakes.
/tmp/install_tflint.sh

FROM scratch
COPY --from=build /tmp/tflint/tflint /tflint
ENTRYPOINT ["/tflint"]
48 changes: 48 additions & 0 deletions src/projects/eps-storage-terraform/.devcontainer/scripts/install_tflint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
#!/usr/bin/env bash

set -euo pipefail
export DEBIAN_FRONTEND=noninteractive

DEFAULT_INSTALL_DIR="/usr/local/bin"
INSTALL_DIR="${INSTALL_DIR:-$DEFAULT_INSTALL_DIR}"

case "${TARGETARCH:-}" in
amd64|arm64)
TFLINT_ARCH="${TARGETARCH}"
;;
*)
echo "Unsupported or missing TARGETARCH: '${TARGETARCH:-}'"
echo "Expected one of: amd64, arm64"
exit 1
;;
esac

if ! command -v curl >/dev/null 2>&1 || ! command -v unzip >/dev/null 2>&1; then
apt-get update
apt-get install -y --no-install-recommends curl unzip ca-certificates
fi

if ! command -v gh >/dev/null 2>&1; then
echo "GitHub CLI (gh) is required for attestation verification but was not found"
exit 1
fi

TFLINT_URL="https://github.com/terraform-linters/tflint/releases/download/${TFLINT_VERSION}/tflint_linux_${TFLINT_ARCH}.zip"
TFLINT_ASSET_NAME="tflint_linux_${TFLINT_ARCH}.zip"
CHECKSUMS_URL="https://github.com/terraform-linters/tflint/releases/download/${TFLINT_VERSION}/checksums.txt"
tmp_dir="$(mktemp -d)"
Comment on lines +30 to +33
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because the script runs with set -u, referencing ${TFLINT_VERSION} will cause an immediate exit with a generic 'unbound variable' error if it isn't provided by the caller. Add an explicit check (with a clear message) or a default value before constructing the download URLs so failures are actionable.

Copilot uses AI. Check for mistakes.
trap 'rm -rf "${tmp_dir}"' EXIT

curl -fsSL "${CHECKSUMS_URL}" -o "${tmp_dir}/checksums.txt"
gh attestation verify "${tmp_dir}/checksums.txt" -R terraform-linters/tflint

curl -fsSL "${TFLINT_URL}" -o "${tmp_dir}/${TFLINT_ASSET_NAME}"
(
cd "${tmp_dir}"
sha256sum --ignore-missing -c checksums.txt
)

unzip -q "${tmp_dir}/${TFLINT_ASSET_NAME}" -d "${tmp_dir}"

mkdir -p "$INSTALL_DIR"
install -m 0755 "$tmp_dir/tflint" "${INSTALL_DIR}/tflint"
2 changes: 1 addition & 1 deletion src/projects/eps-storage-terraform/.devcontainer/scripts/root_install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/usr/bin/env bash

set -e
set -euo pipefail

# clean up
apt-get clean
Expand Down
Loading