From 8c9db20d6b5126401f560fc57c6b642684834ab8 Mon Sep 17 00:00:00 2001 From: YvesCesar Date: Sat, 14 Nov 2026 10:13:17 -0400 Subject: [PATCH] fix: pin build artifacts, base images and workflow actions Signed-off-by: YvesCesar --- .docker/mariadb/Dockerfile | 2 +- .docker/wordpress/Dockerfile | 10 ++++---- .github/workflows/bats-tests.yml | 6 ++--- .github/workflows/docker-publish.yml | 16 ++++++------- .github/workflows/shellcheck.yml | 4 ++-- common-services.yml | 2 +- renovate.json | 19 +++++++++++++++- tests/security/build-pins.bats | 34 ++++++++++++++++++++++++++++ 8 files changed, 72 insertions(+), 21 deletions(-) create mode 100644 tests/security/build-pins.bats diff --git a/.docker/mariadb/Dockerfile b/.docker/mariadb/Dockerfile index 8cec535..235adae 100644 --- a/.docker/mariadb/Dockerfile +++ b/.docker/mariadb/Dockerfile @@ -1,4 +1,4 @@ -FROM mariadb +FROM mariadb:13.0.2@sha256:54f493ea0d60b621a5bff84e5b20100f8b86b6efa6b79158e04756c5194a5e4d RUN apt-get update && \ apt-get install -y \ diff --git a/.docker/wordpress/Dockerfile b/.docker/wordpress/Dockerfile index 109861a..6ad62db 100644 --- a/.docker/wordpress/Dockerfile +++ b/.docker/wordpress/Dockerfile @@ -12,18 +12,18 @@ RUN apt-get install -y \ yq # Install PHP Extensions -ADD https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/ -RUN chmod uga+x /usr/local/bin/install-php-extensions && sync \ - && install-php-extensions \ +COPY --from=mlocati/php-extension-installer:2.13.2@sha256:4fd45396c16685266d32bf147a24ecd5e81029d3820295895bf4a90131190ac9 /usr/bin/install-php-extensions /usr/local/bin/ +RUN install-php-extensions \ xdebug \ intl # Install wp-cli -RUN curl https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar --output /usr/bin/wp +RUN curl -fsSL https://github.com/wp-cli/wp-cli/releases/download/v2.12.0/wp-cli-2.12.0.phar --output /usr/bin/wp \ + && echo "be928f6b8ca1e8dfb9d2f4b75a13aa4aee0896f8a9a0a1c45cd5d2c98605e6172e6d014dda2e27f88c98befc16c040cbb2bd1bfa121510ea5cdf5f6a30fe8832 /usr/bin/wp" | sha512sum -c - RUN chmod +x /usr/bin/wp RUN wp --info -COPY --from=composer /usr/bin/composer /usr/bin/composer +COPY --from=composer:2.11.2@sha256:5bcb28b8d0edc4091125f8218f9d088f998bdfc843f8fbb9a4beb4dcd8625684 /usr/bin/composer /usr/bin/composer COPY config/php.ini /usr/local/etc/php/conf.d/ diff --git a/.github/workflows/bats-tests.yml b/.github/workflows/bats-tests.yml index 70717ca..c1b1c3d 100644 --- a/.github/workflows/bats-tests.yml +++ b/.github/workflows/bats-tests.yml @@ -11,9 +11,9 @@ jobs: name: Bats infrastructure tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Bats-core - uses: bats-core/bats-action@4.0.0 + uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0 with: support-install: false assert-install: false @@ -22,6 +22,6 @@ jobs: - name: Run Bats tests run: bats tests/security - name: ShellCheck Bats helpers - uses: ludeeus/action-shellcheck@master + uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 with: scandir: tests/security/helpers \ No newline at end of file diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 26577a7..1455c9a 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -29,17 +29,17 @@ jobs: packages: write steps: - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Cache Docker layers id: docker-cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: /tmp/.buildx-cache key: wordpress-buildx-${{ github.sha }} @@ -48,14 +48,14 @@ jobs: - name: Log in to GitHub Container Registry if: github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build container image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: .docker/wordpress file: .docker/wordpress/Dockerfile @@ -71,7 +71,7 @@ jobs: - name: Push container image if: github.ref == 'refs/heads/main' - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: .docker/wordpress file: .docker/wordpress/Dockerfile @@ -93,7 +93,7 @@ jobs: - name: Save Docker cache if: steps.docker-cache.outputs.cache-hit != 'true' - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: /tmp/.buildx-cache key: wordpress-buildx-${{ github.sha }} diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml index 5b05073..1150915 100644 --- a/.github/workflows/shellcheck.yml +++ b/.github/workflows/shellcheck.yml @@ -11,8 +11,8 @@ jobs: name: Shellcheck runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Run ShellCheck - uses: ludeeus/action-shellcheck@master + uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 with: scandir: .docker/ diff --git a/common-services.yml b/common-services.yml index 1d45bfc..f37fa0d 100644 --- a/common-services.yml +++ b/common-services.yml @@ -27,7 +27,7 @@ services: - "host.docker.internal:host-gateway" nginx: - image: nginx + image: nginx:1.31.8@sha256:165ddde8751e75a1c907d24ef10d9f6deb08b57e0fe56caf67512486aff76d82 restart: unless-stopped volumes: - ./volumes/wordpress:/var/www/html:ro diff --git a/renovate.json b/renovate.json index 1ac139d..be6506d 100644 --- a/renovate.json +++ b/renovate.json @@ -1,10 +1,18 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "enabledManagers": [ - "custom.regex" + "custom.regex", + "dockerfile", + "docker-compose", + "github-actions" ], "dependencyDashboard": false, "separateMinorPatch": true, + "docker-compose": { + "managerFilePatterns": [ + "/(^|/)common-services\\.yml$/" + ] + }, "customManagers": [ { "customType": "regex", @@ -32,6 +40,15 @@ "minor" ], "enabled": false + }, + { + "matchManagers": [ + "docker-compose" + ], + "matchPackageNames": [ + "ghcr.io/librecodecoop/wordpress-docker" + ], + "enabled": false } ] } diff --git a/tests/security/build-pins.bats b/tests/security/build-pins.bats new file mode 100644 index 0000000..306163c --- /dev/null +++ b/tests/security/build-pins.bats @@ -0,0 +1,34 @@ +#!/usr/bin/env bats + +setup() { + cd "$BATS_TEST_DIRNAME/../.." +} + +@test "the WordPress image does not download floating artifacts" { + run grep -nE 'releases/latest|gh-pages|^ADD ' .docker/wordpress/Dockerfile + [ "${status}" -eq 1 ] +} + +@test "images copied into the WordPress image are pinned by digest" { + run grep -nE '^COPY --from=' .docker/wordpress/Dockerfile + [ "${status}" -eq 0 ] + run grep -nvE '^COPY --from=[^ ]+:[^ @]+@sha256:[a-f0-9]{64} ' <(grep -E '^COPY --from=' .docker/wordpress/Dockerfile) + [ "${status}" -eq 1 ] +} + +@test "WP-CLI is downloaded from a release and verified" { + grep -qE 'curl -fsSL https://github.com/wp-cli/wp-cli/releases/download/v[0-9.]+/wp-cli-[0-9.]+\.phar' .docker/wordpress/Dockerfile + grep -qE 'sha512sum -c' .docker/wordpress/Dockerfile +} + +@test "nginx and MariaDB images are pinned" { + grep -qE '^ image: nginx:[0-9.]+@sha256:[a-f0-9]{64}$' common-services.yml + grep -qE '^FROM mariadb:[0-9.]+@sha256:[a-f0-9]{64}$' .docker/mariadb/Dockerfile +} + +@test "workflow actions are pinned by commit" { + run grep -hnE '^\s*-?\s*uses: ' .github/workflows/*.yml + [ "${status}" -eq 0 ] + run grep -hE '^\s*-?\s*uses: ' .github/workflows/*.yml + ! printf '%s\n' "${output}" | grep -vE 'uses: [^@]+@[a-f0-9]{40} # v?[0-9]+\.[0-9]+\.[0-9]+$' +}