generated from CDCgov/template
-
Notifications
You must be signed in to change notification settings - Fork 41
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into dependabot/npm_and_yarn/frontend-react/route…
…r-362ca8d24e
- Loading branch information
Showing
13 changed files
with
176 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -25,7 +25,7 @@ | |
| "automated", | ||
| "checks", | ||
| "deployment", | ||
| "DevOps", | ||
| "DevSecOps", | ||
| "pipeline", | ||
| "scan", | ||
| "workflow" | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| .dockerignore | ||
| *.sh | ||
| build | ||
| Dockerfile* | ||
| node_modules | ||
| node_modules | ||
| **/.DS_Store |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 20.15 | ||
| 20.15.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| # Start with the latest version of hardened builder image | ||
| FROM cgr.dev/chainguard/wolfi-base:latest AS builder | ||
|
|
||
| # Install required dependencies | ||
| RUN apk add --no-cache bash curl git ca-certificates libstdc++ coreutils && \ | ||
| update-ca-certificates && \ | ||
| touch ~/.bash_profile | ||
|
|
||
| # Get desired Node.js version and install it | ||
| COPY .nvmrc /tmp/.nvmrc | ||
| RUN export NODE_VERSION=$(cat /tmp/.nvmrc | tr -d '[:space:]') && \ | ||
| ARCH=$(uname -m) && \ | ||
| echo $ARCH && \ | ||
| case $ARCH in \ | ||
| x86_64) ARCH_NAME="x64";; \ | ||
| aarch64) ARCH_NAME="arm64";; \ | ||
| *) echo "Unsupported architecture: $ARCH" && exit 1;; \ | ||
| esac && \ | ||
| echo "Architecture: $ARCH_NAME" && \ | ||
| PLATFORM_ARCH="linux-${ARCH_NAME}" && \ | ||
| echo "Platform architecture: $PLATFORM_ARCH https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-${PLATFORM_ARCH}.tar.gz" && \ | ||
| echo "Installing Node.js version: ${NODE_VERSION} for $ARCH_NAME" && \ | ||
| DOWNLOAD_URL="https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-${PLATFORM_ARCH}.tar.gz" && \ | ||
| echo "Downloading from: $DOWNLOAD_URL" && \ | ||
| curl -fsSL --retry 3 "$DOWNLOAD_URL" -o /tmp/node.tar.gz && \ | ||
| tar -xzf /tmp/node.tar.gz -C /usr/local --strip-components=1 && \ | ||
| rm /tmp/node.tar.gz /tmp/.nvmrc && \ | ||
| echo -n "Node.js installed version: " && node -v && \ | ||
| echo -n "npm installed version: " && npm -v && \ | ||
| apk del glibc # Remove glibc package to resolve CVE CVE-2025-0395 | ||
|
|
||
|
|
||
| # Install yarn and resolve vulnerability in cross-spawn, by upgrading it to a version with resolved CVE | ||
| # Newly found CVEs can be resolved in similar manner - by upgrading to the closest fixed version | ||
| RUN apk add --no-cache yarn && \ | ||
| npm install -g [email protected] | ||
| # Extract Node.js version from the image | ||
| SHELL ["/bin/ash", "-o", "pipefail", "-c"] | ||
| RUN node --version | awk -F'v' '{print $2}' | ||
| WORKDIR /app | ||
| # Prep package manager as root and drop privileges | ||
| USER root | ||
| COPY --chown=nonroot . . | ||
| RUN chown nonroot:nonroot ./ && npm install -g corepack | ||
| # Run install/buiuld as unprivileged user | ||
| USER nonroot | ||
| RUN yarn install --immutable && yarn build:production | ||
|
|
||
| # Web server stage | ||
| # This image runs as a unprivileged user by default, so there's no need to explicitly set user - see the Note block in the link below for more context | ||
| # https://edu.chainguard.dev/chainguard/chainguard-images/getting-started/nginx/#advanced-usage | ||
| FROM cgr.dev/chainguard/nginx AS server | ||
| COPY nginx.conf /etc/nginx/nginx.conf | ||
| COPY --from=builder /app/build /usr/share/nginx/html | ||
| EXPOSE 8080 | ||
| CMD ["nginx", "-g", "daemon off;"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| pid /var/run/nginx.pid; | ||
|
|
||
| http { | ||
| include mime.types; | ||
|
|
||
| server { | ||
| listen 8080; | ||
| server_name localhost; | ||
|
|
||
| location / { | ||
| root /usr/share/nginx/html; | ||
| index index.html index.htm; | ||
| try_files $uri /index.html; # Pass all non-files to our react app | ||
| } | ||
| } | ||
| } | ||
|
|
||
| events {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| docker build . --build-arg NODE_VERSION=$(cat .nvmrc) -t rs-frontend:latest |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| #!/usr/bin/env pwsh | ||
|
|
||
| # Define parameters | ||
| param ( | ||
| [string]$OutputFile = "azure-resources--powershell.csv" | ||
| ) | ||
|
|
||
| # Output header | ||
| "Location,Name,Resource Group" | Out-File -FilePath "azure-resources.csv" -Encoding utf8 ; | ||
|
|
||
| # Fetch Azure resources and append to CSV | ||
| az resource list --query '[].{"Location":location,"Name":name,"Resource Group":resourceGroup}' --output tsv | | ||
| ForEach-Object { $_ -replace "`t", "," } | | ||
| Out-File -FilePath $OutputFile -Append -Encoding utf8 ; | ||
|
|
||
| # Display the contents of the generated CSV | ||
| Get-Content -Path $OutputFile ; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| #!/usr/bin/env python | ||
|
|
||
| import subprocess | ||
| import csv | ||
| import argparse | ||
|
|
||
| # Set up argument parser | ||
| parser = argparse.ArgumentParser( description="Fetch Azure resources and export them to a CSV file." ) ; | ||
| parser.add_argument( | ||
| "--output-file", | ||
| type=str, | ||
| default="azure-resources--python.csv", | ||
| help="Path to the output CSV file (default: azure-resources--python.csv)" | ||
| ) ; | ||
|
|
||
| # Parse arguments | ||
| args = parser.parse_args() ; | ||
| output_file = args.output_file ; | ||
|
|
||
| # Command to fetch Azure resources | ||
| cmd = [ | ||
| "az", "resource", "list", | ||
| "--query", "[].{\"Location\":location, \"Name\":name, \"Resource Group\":resourceGroup}", | ||
| "--output", "tsv" | ||
| ] ; | ||
|
|
||
| # Run the Azure CLI command | ||
| result = subprocess.run( cmd, stdout=subprocess.PIPE, text=True ) ; | ||
|
|
||
| # Write header and data to CSV file | ||
| with open( output_file, "w", newline="" ) as csvfile: | ||
| writer = csv.writer( csvfile ) ; | ||
| writer.writerow( ["Location", "Name", "Resource Group"] ) ; | ||
| for line in result.stdout.splitlines(): | ||
| writer.writerow( line.split( "\t" ) ) ; | ||
|
|
||
| # Print the contents of the generated CSV | ||
| with open( output_file, "r" ) as csvfile: | ||
| print( csvfile.read() ) ; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| if [[ ${#1} -gt 0 ]]; then | ||
| OutputFile="${1}" ; | ||
| else OutputFile="azure-resources--shell.csv" ; | ||
| fi ; | ||
|
|
||
| echo "Location,Name,Resource Group" \ | ||
| | cat - <( az resource list --query "[].{\"Location\":location, \"Name\":name, \"Resource Group\":resourceGroup}" --output tsv \ | ||
| | sed 's/\t/,/g' ) \ | ||
| > ${OutputFile} ; | ||
|
|
||
| cat ${OutputFile} ; |