Repository navigation
Scaffold hardened Axum application Docker recipes #401
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,203 @@ | ||
| name: Axum container preparation | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: [main] | ||
| paths: | ||
| - .github/workflows/axum-container.yml | ||
| - Cargo.toml | ||
| - Cargo.lock | ||
| - .tool-versions | ||
| - crates/** | ||
| - examples/app-demo/** | ||
| - examples/container-publishing/** | ||
| - examples/axum-deployment/** | ||
| - scripts/*axum_container*.sh | ||
| - scripts/axum_container*.mjs | ||
| - scripts/package*.json | ||
| - scripts/tests/*axum_container*.mjs | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - .github/workflows/axum-container.yml | ||
| - Cargo.toml | ||
| - Cargo.lock | ||
| - .tool-versions | ||
| - crates/** | ||
| - examples/app-demo/** | ||
| - examples/container-publishing/** | ||
| - examples/axum-deployment/** | ||
| - scripts/*axum_container*.sh | ||
| - scripts/axum_container*.mjs | ||
| - scripts/package*.json | ||
| - scripts/tests/*axum_container*.mjs | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| prepare: | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 20 | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Retrieve Node version | ||
| id: node-version | ||
| run: echo "node-version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT" | ||
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | ||
| with: | ||
| node-version: ${{ steps.node-version.outputs.node-version }} | ||
| - name: Use the declared Rust toolchain | ||
| run: | | ||
| version=$(awk '$1 == "rust" { print $2 }' .tool-versions) | ||
| rustup toolchain install "$version" --profile minimal | ||
| echo "RUSTUP_TOOLCHAIN=$version" >> "$GITHUB_ENV" | ||
| - name: Install framework helper dependencies | ||
| run: npm ci --prefix scripts --ignore-scripts | ||
| - name: Prepare one application and lockfile | ||
| run: | | ||
| ./scripts/prepare_generated_axum_container.sh "$RUNNER_TEMP/fixture" | ||
| AXUM_PREPARED_CONTEXT="$RUNNER_TEMP/fixture/container-probe" \ | ||
| node --test scripts/tests/test_axum_container*.test.mjs | ||
| tar -C "$RUNNER_TEMP/fixture" -cf "$RUNNER_TEMP/context.tar" container-probe | ||
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | ||
| with: | ||
| name: axum-context-${{ github.run_id }}-${{ github.run_attempt }} | ||
| path: ${{ runner.temp }}/context.tar | ||
| if-no-files-found: error | ||
| retention-days: 7 | ||
|
|
||
| native: | ||
| needs: prepare | ||
| timeout-minutes: 30 | ||
| # Framework packaging evidence is not application release approval. | ||
| env: | ||
| SCAN_POLICY: report-only | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - arch: amd64 | ||
| runner: ubuntu-24.04 | ||
| - arch: arm64 | ||
| runner: ubuntu-24.04-arm | ||
| runs-on: ${{ matrix.runner }} | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Retrieve Node version | ||
| id: node-version | ||
| run: echo "node-version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT" | ||
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | ||
| with: | ||
| node-version: ${{ steps.node-version.outputs.node-version }} | ||
| - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 | ||
| with: | ||
| name: axum-context-${{ github.run_id }}-${{ github.run_attempt }} | ||
| path: ${{ runner.temp }}/context | ||
| digest-mismatch: error | ||
| - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | ||
| with: | ||
| version: v0.37.0 | ||
| # Reuse the daemon; the handoff helper creates the pinned build instance. | ||
| driver: docker | ||
| use: false | ||
| - name: Install framework helper dependencies | ||
| run: npm ci --prefix scripts --ignore-scripts | ||
| - name: Native image, packaging, scan and OCI identity checks | ||
| env: | ||
| ARCH: ${{ matrix.arch }} | ||
| run: | | ||
| tar -C "$RUNNER_TEMP/context" -xf "$RUNNER_TEMP/context/context.tar" --no-same-owner | ||
| ./scripts/test_axum_container_handoff.sh build \ | ||
| "$RUNNER_TEMP/context/container-probe" "$RUNNER_TEMP/accepted" \ | ||
| "linux/$ARCH" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" | ||
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | ||
| with: | ||
| name: accepted-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }} | ||
| path: | | ||
| ${{ runner.temp }}/accepted/image.tar | ||
| ${{ runner.temp }}/accepted/receipt.json | ||
| ${{ runner.temp }}/accepted/inputs.json | ||
| ${{ runner.temp }}/accepted/scan.json | ||
| ${{ runner.temp }}/accepted/scanner.json | ||
| ${{ runner.temp }}/accepted/sbom.json | ||
| ${{ runner.temp }}/accepted/provenance.json | ||
| ${{ runner.temp }}/accepted/rust-advisories.json | ||
| if-no-files-found: error | ||
| retention-days: 7 | ||
| - name: Retain sanitized failure evidence separately | ||
| if: failure() | ||
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | ||
| with: | ||
| name: failed-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }} | ||
| path: | | ||
| ${{ runner.temp }}/accepted/*.log | ||
| ${{ runner.temp }}/accepted/scan.json | ||
| ${{ runner.temp }}/accepted/scanner.json | ||
| ${{ runner.temp }}/accepted/image.json | ||
| ${{ runner.temp }}/accepted/inputs.json | ||
| ${{ runner.temp }}/accepted/rust-advisories.json | ||
| ${{ runner.temp }}/accepted/smoke | ||
| if-no-files-found: warn | ||
| retention-days: 7 | ||
|
|
||
| handoff: | ||
| needs: native | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 15 | ||
| env: | ||
| SCAN_POLICY: report-only | ||
| permissions: | ||
| contents: read | ||
| actions: read | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Retrieve Node version | ||
| id: node-version | ||
| run: echo "node-version=$(awk '$1 == "nodejs" { print $2 }' .tool-versions)" >> "$GITHUB_OUTPUT" | ||
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | ||
| with: | ||
| node-version: ${{ steps.node-version.outputs.node-version }} | ||
| - name: Select exact immutable artifacts from this run and attempt | ||
| id: artifacts | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: | | ||
| gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" > "$RUNNER_TEMP/artifacts.json" | ||
|
Collaborator
There was a problem hiding this comment. ⛏ No pagination: |
||
| ids=$(node examples/container-publishing/verify_artifacts.mjs artifact-ids \ | ||
| "$RUNNER_TEMP/artifacts.json" --run-id "$GITHUB_RUN_ID" --attempt "$GITHUB_RUN_ATTEMPT") | ||
| echo "ids=$ids" >> "$GITHUB_OUTPUT" | ||
| - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 | ||
| with: | ||
| artifact-ids: ${{ steps.artifacts.outputs.ids }} | ||
| path: ${{ runner.temp }}/bundles | ||
| digest-mismatch: error | ||
| - name: Import accepted variants in a separate job without rebuilding | ||
| run: | | ||
| for arch in amd64 arm64; do | ||
| ./scripts/test_axum_container_handoff.sh import \ | ||
| "$RUNNER_TEMP/bundles/accepted-$arch-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \ | ||
| "$RUNNER_TEMP/import-$arch" "linux/$arch" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" | ||
| done | ||
| - name: Assemble and verify a localhost runtime index without external publication | ||
| run: | | ||
| source examples/container-publishing/tools.env | ||
| registry="axum-index-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" | ||
| trap 'docker rm -f "$registry" >/dev/null 2>&1 || true' EXIT | ||
| docker run -d --name "$registry" -p 127.0.0.1::5000 "$REGISTRY_IMAGE" | ||
| port=$(docker port "$registry" 5000/tcp | awk -F: '{print $NF}') | ||
| for _ in $(seq 1 30); do curl --fail --silent "http://127.0.0.1:$port/v2/" && break; sleep 1; done | ||
|
Collaborator
There was a problem hiding this comment. ⛏ Registry wait never fails: if the registry never comes up the loop just ends and |
||
| ./examples/container-publishing/publish.sh "127.0.0.1:$port/fixture" fixture \ | ||
| "$RUNNER_TEMP/bundles/accepted-amd64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \ | ||
| "$RUNNER_TEMP/bundles/accepted-arm64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \ | ||
| "$RUNNER_TEMP/index" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
♻️ Duplicated Node setup: this "Retrieve Node version" +
setup-nodepair is repeated in three jobs (and deploy-action).setup-nodesupportsnode-version-file: .tool-versionsdirectly, which removes the awk step. Also ⛏ the pin comment is# v6; other actions name the exact release.