Skip to content

Commit 5a45c1f

Browse files
lelialelia
authored
Pin opengrep version, add Docker smoketest (#41)
* Pin opengrep version, update trufflehog version Signed-off-by: lelia <lelia@socket.dev> * Update version refs in README Signed-off-by: lelia <lelia@socket.dev> * Apply same version pinning logic to app_tests/Dockerfile Signed-off-by: lelia <lelia@socket.dev> * Update docs to explain version pinning, overrides, and testing Signed-off-by: lelia <lelia@socket.dev> * Update docker script name Signed-off-by: lelia <lelia@socket.dev> * Add smoketest script for testing Docker build Signed-off-by: lelia <lelia@socket.dev> * Add basic workflow for testing changes to Dockerfiles Signed-off-by: lelia <lelia@socket.dev> * Use commit hash instead of v4 for checkout Signed-off-by: lelia <lelia@socket.dev> --------- Signed-off-by: lelia <lelia@socket.dev>
1 parent dbd4064 commit 5a45c1f

File tree

6 files changed

+208
-8
lines changed

6 files changed

+208
-8
lines changed

‎.github/workflows/smoke-test.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: smoke-test
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'Dockerfile'
8+
- 'scripts/smoke-test-docker.sh'
9+
- '.github/workflows/smoke-test.yml'
10+
pull_request:
11+
paths:
12+
- 'Dockerfile'
13+
- 'scripts/smoke-test-docker.sh'
14+
- '.github/workflows/smoke-test.yml'
15+
schedule:
16+
- cron: '0 */12 * * *' # every 12 hours
17+
workflow_dispatch:
18+
19+
permissions:
20+
contents: read
21+
22+
concurrency:
23+
group: smoke-test-${{ github.ref }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
smoke-test:
28+
runs-on: ubuntu-latest
29+
timeout-minutes: 30
30+
env:
31+
DOCKER_BUILDKIT: "1"
32+
SMOKE_TEST_BUILD_PROGRESS: plain
33+
steps:
34+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
35+
- name: 🐳 smoke test
36+
run: bash ./scripts/smoke-test-docker.sh --image-tag socket-basics:smoke-test

‎Dockerfile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,12 @@ ARG TRIVY_VERSION=v0.69.2
2323
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "${TRIVY_VERSION}"
2424

2525
# Install Trufflehog
26-
ARG TRUFFLEHOG_VERSION=v3.93.3
26+
ARG TRUFFLEHOG_VERSION=v3.93.6
2727
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin "${TRUFFLEHOG_VERSION}"
2828

2929
# Install OpenGrep (connector/runtime dependency)
30-
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash
30+
ARG OPENGREP_VERSION=v1.16.2
31+
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash -s -- -v "${OPENGREP_VERSION}"
3132

3233
# Copy the specific files needed for the project
3334
COPY socket_basics /socket-basics/socket_basics

‎README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -154,12 +154,13 @@ docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.1.2 \
154154
--console-tabular-enabled
155155
```
156156

157-
Tip: If you need specific Trivy or TruffleHog versions, you can override them at build time:
157+
Tip: If you need specific Trivy, TruffleHog, or OpenGrep versions, you can override them at build time:
158158

159159
```bash
160160
docker build \
161-
--build-arg TRIVY_VERSION=v0.67.2 \
162-
--build-arg TRUFFLEHOG_VERSION=v3.93.3 \
161+
--build-arg TRIVY_VERSION=v0.69.2 \
162+
--build-arg TRUFFLEHOG_VERSION=v3.93.6 \
163+
--build-arg OPENGREP_VERSION=v1.16.2 \
163164
-t socketdev/socket-basics:1.1.2 .
164165
```
165166

‎app_tests/Dockerfile‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,16 @@ RUN apt-get update && \
2323
RUN curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s -- -b /usr/local/bin v2.21.4
2424

2525
# Install Trivy
26-
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.18.3
26+
ARG TRIVY_VERSION=v0.69.2
27+
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "${TRIVY_VERSION}"
2728

2829
# Install Trufflehog
29-
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
30+
ARG TRUFFLEHOG_VERSION=v3.93.6
31+
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin "${TRUFFLEHOG_VERSION}"
32+
33+
# Install OpenGrep (connector/runtime dependency)
34+
ARG OPENGREP_VERSION=v1.16.2
35+
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash -s -- -v "${OPENGREP_VERSION}"
3036

3137
# Install Bandit using uv as a tool
3238
RUN uv tool install bandit
@@ -50,7 +56,7 @@ COPY pyproject.toml uv.lock /scripts/
5056
# Install Python dependencies using uv
5157
WORKDIR /scripts
5258
RUN uv sync --frozen && uv pip install light-s3-client
53-
ENV PATH="/scripts/.venv/bin:$PATH"
59+
ENV PATH="/scripts/.venv/bin:/root/.opengrep/cli/latest:$PATH"
5460

5561
# Define entrypoint
5662
ENTRYPOINT ["/socket-security-tools/entrypoint.sh"]

‎docs/local-install-docker.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,20 @@ docker build -t myorg/security-scanner:1.1.2 .
6565
docker build --platform linux/amd64 -t socket-basics:1.1.2 .
6666
```
6767

68+
### Build with Custom Tool Versions
69+
70+
The image pins Trivy, TruffleHog, and OpenGrep to specific versions. You can override any of them at build time:
71+
72+
```bash
73+
docker build \
74+
--build-arg TRIVY_VERSION=v0.69.2 \
75+
--build-arg TRUFFLEHOG_VERSION=v3.93.6 \
76+
--build-arg OPENGREP_VERSION=v1.16.2 \
77+
-t socket-basics:1.1.2 .
78+
```
79+
80+
Omit any `--build-arg` to use the default version for that tool. For the app tests image, build from the `app_tests` directory and use the same build args.
81+
6882
### Verify Installation
6983

7084
```bash
@@ -76,6 +90,28 @@ docker run --rm socket-basics:1.1.2 opengrep --version
7690
docker run --rm socket-basics:1.1.2 trufflehog --version
7791
```
7892

93+
### Smoke Test
94+
95+
To test that the pinned tool versions still work, run:
96+
97+
```bash
98+
./scripts/smoke-test-docker.sh
99+
```
100+
101+
Add `--build-progress plain` when you want verbose Docker build logs:
102+
103+
```bash
104+
./scripts/smoke-test-docker.sh --build-progress plain
105+
```
106+
107+
With `--app-tests` to also test the app_tests image (requires full build context):
108+
109+
```bash
110+
./scripts/smoke-test-docker.sh --app-tests
111+
```
112+
113+
This builds the image(s) and verifies Trivy, TruffleHog, and OpenGrep are installed and executable. A GitHub Action runs this on Dockerfile changes and daily.
114+
79115
## Running Scans
80116

81117
### Basic Scan with Volume Mount

‎scripts/smoke-test-docker.sh‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
5+
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
6+
IMAGE_TAG="${IMAGE_TAG:-socket-basics:smoke-test}"
7+
APP_TESTS_IMAGE_TAG="${APP_TESTS_IMAGE_TAG:-socket-basics-app-tests:smoke-test}"
8+
RUN_APP_TESTS=false
9+
BUILD_PROGRESS="${SMOKE_TEST_BUILD_PROGRESS:-}"
10+
11+
MAIN_TOOLS=(
12+
"socket-basics -h"
13+
"command -v socket"
14+
"trivy --version"
15+
"trufflehog --version"
16+
"opengrep --version"
17+
)
18+
19+
APP_TESTS_TOOLS=(
20+
"trivy --version"
21+
"trufflehog --version"
22+
"opengrep --version"
23+
"command -v socket"
24+
)
25+
26+
usage() {
27+
echo "Usage: $0 [--image-tag TAG] [--app-tests] [--build-progress MODE]"
28+
echo " --build-progress: auto|plain|tty (default: auto locally, plain in CI)"
29+
}
30+
31+
while [[ $# -gt 0 ]]; do
32+
case "$1" in
33+
-h|--help) usage; exit 0 ;;
34+
--image-tag)
35+
[[ $# -lt 2 ]] && { echo "Error: --image-tag requires a value"; exit 1; }
36+
IMAGE_TAG="$2"; shift 2
37+
;;
38+
--app-tests) RUN_APP_TESTS=true; shift ;;
39+
--build-progress)
40+
[[ $# -lt 2 ]] && { echo "Error: --build-progress requires a value"; exit 1; }
41+
BUILD_PROGRESS="$2"; shift 2
42+
;;
43+
*) echo "Error: unknown option: $1"; usage; exit 1 ;;
44+
esac
45+
done
46+
47+
if [[ -z "$BUILD_PROGRESS" ]]; then
48+
if [[ "${GITHUB_ACTIONS:-}" == "true" ]]; then
49+
BUILD_PROGRESS="plain"
50+
else
51+
BUILD_PROGRESS="auto"
52+
fi
53+
fi
54+
55+
case "$BUILD_PROGRESS" in
56+
auto|plain|tty) ;;
57+
*) echo "Error: invalid --build-progress '$BUILD_PROGRESS'"; exit 1 ;;
58+
esac
59+
60+
if ! command -v docker >/dev/null 2>&1; then
61+
echo "ERROR: Docker CLI is not installed or not in PATH."
62+
exit 1
63+
fi
64+
if ! docker info >/dev/null 2>&1; then
65+
echo "ERROR: Docker daemon is not reachable."
66+
exit 1
67+
fi
68+
69+
build_args_for_tag() {
70+
local tag="$1"
71+
BUILD_ARGS=(--progress "$BUILD_PROGRESS" -t "$tag")
72+
[[ -n "${TRIVY_VERSION:-}" ]] && BUILD_ARGS+=(--build-arg "TRIVY_VERSION=$TRIVY_VERSION")
73+
[[ -n "${TRUFFLEHOG_VERSION:-}" ]] && BUILD_ARGS+=(--build-arg "TRUFFLEHOG_VERSION=$TRUFFLEHOG_VERSION")
74+
[[ -n "${OPENGREP_VERSION:-}" ]] && BUILD_ARGS+=(--build-arg "OPENGREP_VERSION=$OPENGREP_VERSION")
75+
return 0
76+
}
77+
78+
run_checks() {
79+
local tag="$1"
80+
shift
81+
local checks=("$@")
82+
for cmd in "${checks[@]}"; do
83+
if docker run --rm --entrypoint /bin/sh "$tag" -c "$cmd" > /dev/null 2>&1; then
84+
echo " OK: $cmd"
85+
else
86+
echo " FAIL: $cmd"
87+
docker run --rm --entrypoint /bin/sh "$tag" -c "$cmd" 2>&1 || true
88+
return 1
89+
fi
90+
done
91+
}
92+
93+
cd "$REPO_ROOT"
94+
95+
echo "==> Build main image"
96+
echo "Image: $IMAGE_TAG"
97+
echo "Docker build progress mode: $BUILD_PROGRESS"
98+
build_args_for_tag "$IMAGE_TAG"
99+
main_build_start="$(date +%s)"
100+
docker build "${BUILD_ARGS[@]}" .
101+
main_build_end="$(date +%s)"
102+
echo "Main image build completed in $((main_build_end - main_build_start))s"
103+
104+
echo "==> Verify tools in main image"
105+
run_checks "$IMAGE_TAG" "${MAIN_TOOLS[@]}"
106+
107+
if $RUN_APP_TESTS; then
108+
echo "==> Build app_tests image"
109+
echo "Image: $APP_TESTS_IMAGE_TAG"
110+
build_args_for_tag "$APP_TESTS_IMAGE_TAG"
111+
app_build_start="$(date +%s)"
112+
docker build -f app_tests/Dockerfile "${BUILD_ARGS[@]}" .
113+
app_build_end="$(date +%s)"
114+
echo "app_tests image build completed in $((app_build_end - app_build_start))s"
115+
116+
echo "==> Verify tools in app_tests image"
117+
run_checks "$APP_TESTS_IMAGE_TAG" "${APP_TESTS_TOOLS[@]}"
118+
fi
119+
120+
echo "==> Smoke test passed"

0 commit comments

Comments
 (0)