Scan images via Anchore

UKHomeOffice · Aug 20, 2019 · 3368c25 · 3368c25
1 parent ea07815
commit 3368c25
Show file tree

Hide file tree

Showing 36 changed files with 221 additions and 258 deletions.
diff --git a/.drone.yml b/.drone.yml
@@ -34,6 +34,12 @@ pipeline:
     when:
       event: [push, tag]
 
+  web_scan_image:
+    image: quay.io/ukhomeofficedigital/anchore-submission:latest
+    image_name: platform-hub-web:${DRONE_COMMIT_SHA}
+    when:
+      event: [push, tag]
+
   web_latest_image_to_quay:
     image: docker:17.07.0-ce
     secrets:
@@ -63,49 +69,17 @@ pipeline:
     when:
       event: tag
 
-
   api_tests:
-    image: alpine:3.5
+    image: ruby:2.3.8-alpine
     environment:
-      - SECRET_KEY_BASE=$(head -c30 < /dev/urandom | base64)
       - PHUB_DB_HOST=postgres
-      - PHUB_ELASTICSEARCH_URL=noop
-      - GITHUB_CLIENT_ID=NA
-      - GITHUB_CLIENT_SECRET=NA
-      - AGENT_GITHUB_TOKEN=noop
-      - AGENT_GITHUB_ORG=noop
-      - AGENT_GITLAB_BASE_URL="http://noop"
-      - AGENT_GITLAB_TOKEN=noop
-      - AGENT_GITHUB_ORG_MAIN_TEAM_ID=noop
-      - AGENT_KEYCLOAK_CLIENT_ID=noop
-      - AGENT_KEYCLOAK_CLIENT_SECRET=noop
-      - AGENT_KEYCLOAK_USERNAME=noop
-      - AGENT_KEYCLOAK_PASSWORD=noop
-      - AGENT_KEYCLOAK_BASE_URL=noop
-      - AGENT_KEYCLOAK_REALM=noop
-      - APP_BASE_URL="http://localhost:3000"
-      - EMAIL_FROM_ADDRESS="[email protected]"
-      - EMAIL_MAX_TO_ADDRESSES=10
-      - SLACK_WEBHOOK=noop
-      - FILESTORE_S3_REGION=eu-west-2
-      - FILESTORE_S3_BUCKET_NAME=noop
-      - FILESTORE_S3_ACCESS_KEY_ID=noop
-      - FILESTORE_S3_SECRET_ACCESS_KEY=noop
-      - SQS_REGION=noop
-      - SQS_ACCESS_KEY_ID=noop
-      - SQS_SECRET_ACCESS_KEY=noop
-      - SQS_ECR_AGENT_TASKS_QUEUE=noop
-      - SQS_ECR_AGENT_RESULTS_QUEUE=noop
     commands:
-      - apk update && apk upgrade
-      - apk --update add ca-certificates openssl
+      - apk -U add ca-certificates libressl postgresql-client postgresql-dev build-base make
       - update-ca-certificates
-      - apk --update add bash ruby ruby-irb ruby-rake ruby-io-console ruby-json ruby-bigdecimal libstdc++ tzdata postgresql-client
-      - apk --update add build-base ruby-dev libc-dev libressl-dev postgresql-dev libffi-dev zlib-dev
       - "echo 'gem: --no-document' > /etc/gemrc && gem install bundler -v 1.16.2"
       - cd platform-hub-api
-      - "/bin/bash -c 'bundle install --jobs 20 --retry 5 --deployment --no-cache'"
-      - "/bin/bash -c 'bin/setup && bundle exec rspec'"
+      - bundle install --jobs 20 --retry 5 --deployment
+      - ./test.sh
     when:
       event: [push, tag]
 
@@ -123,64 +97,39 @@ pipeline:
     image: docker:17.10.0
     environment:
       - DOCKER_HOST=tcp://172.17.0.1:2375
-      - PORT=6055
       - POSTGRES_USER=phub
       - POSTGRES_PASSWORD=phub_password
     commands:
-      - >
-          docker run
-          -d
-          --name phub-api-postgres-${DRONE_BUILD_NUMBER}
-          -e POSTGRES_USER
-          -e POSTGRES_PASSWORD
-          postgres:9.6.1
+      - docker run -d -p 5432:5432 --name phub-api-postgres-${DRONE_BUILD_NUMBER} -e POSTGRES_USER -e POSTGRES_PASSWORD postgres:9.6.1
       - sleep 5
       - 'until docker exec -e POSTGRES_USER -e POSTGRES_PASSWORD phub-api-postgres-${DRONE_BUILD_NUMBER} psql -U $${POSTGRES_USER} -c "select 1" > /dev/null 2>&1; do sleep 2; done'
       - >
           docker run
-          --name platform-hub-api-test
-          -t --rm
-          --link phub-api-postgres-${DRONE_BUILD_NUMBER}:phub-postgres-${DRONE_BUILD_NUMBER}
-          -e PORT
-          -e PHUB_DB_HOST=phub-postgres-${DRONE_BUILD_NUMBER}
-          -e PHUB_DB_NAME=phub_development
-          -e PHUB_DB_USERNAME=$${POSTGRES_USER}
-          -e PHUB_DB_PASSWORD=$${POSTGRES_PASSWORD}
-          -e PHUB_ELASTICSEARCH_URL=noop
-          -e RAILS_LOG_TO_STDOUT=true
-          -e SECRET_KEY_BASE=$(head -c30 < /dev/urandom | base64)
-          -e GITHUB_CLIENT_ID=NA
-          -e GITHUB_CLIENT_SECRET=NA
-          -e AGENT_GITHUB_TOKEN=noop
-          -e AGENT_GITHUB_ORG=noop
-          -e AGENT_GITHUB_ORG_MAIN_TEAM_ID=noop
-          -e AGENT_GITLAB_BASE_URL="http://noop"
-          -e AGENT_GITLAB_TOKEN=noop
-          -e AGENT_KEYCLOAK_CLIENT_ID=noop
-          -e AGENT_KEYCLOAK_CLIENT_SECRET=noop
-          -e AGENT_KEYCLOAK_USERNAME=noop
-          -e AGENT_KEYCLOAK_PASSWORD=noop
-          -e AGENT_KEYCLOAK_BASE_URL=noop
-          -e AGENT_KEYCLOAK_REALM=noop
-          -e APP_BASE_URL="http://localhost:$${PORT}"
-          -e EMAIL_FROM_ADDRESS="[email protected]"
-          -e EMAIL_MAX_TO_ADDRESSES=10
-          -e SLACK_WEBHOOK=noop
-          -e FILESTORE_S3_REGION=eu-west-2
-          -e FILESTORE_S3_BUCKET_NAME=noop
-          -e FILESTORE_S3_ACCESS_KEY_ID=noop
-          -e FILESTORE_S3_SECRET_ACCESS_KEY=noop
-          -e SQS_REGION=noop
-          -e SQS_ACCESS_KEY_ID=noop
-          -e SQS_SECRET_ACCESS_KEY=noop
-          -e SQS_ECR_AGENT_TASKS_QUEUE=noop
-          -e SQS_ECR_AGENT_RESULTS_QUEUE=noop
+          --name phub-api-${DRONE_BUILD_NUMBER}
+          -t --rm --env-file=platform-hub-api/.env.test
+          -e PHUB_DB_HOST=phub-api-postgres-${DRONE_BUILD_NUMBER}
+          --link phub-api-postgres-${DRONE_BUILD_NUMBER}
           platform-hub-api:${DRONE_COMMIT_SHA}
-          /bin/bash -c "cd /app; bin/setup && bin/rails server -d; sleep 5; curl -s -f http://127.0.0.1:$${PORT}/healthz"
-      - docker kill phub-api-postgres-${DRONE_BUILD_NUMBER}
+          /bin/bash -c "cd /app; bin/setup; bin/rails server -d; sleep 5; curl -s -f http://127.0.0.1:3000/healthz"
+    when:
+      event: [push, tag]
+
+  cleanup_postgres:
+    image: docker:17.10.0
+    environment:
+      - DOCKER_HOST=tcp://172.17.0.1:2375
+    commands:
       - docker rm -f phub-api-postgres-${DRONE_BUILD_NUMBER}
     when:
       event: [push, tag]
+      status: [success, failure]
+
+  api_scan_image:
+    image: quay.io/ukhomeofficedigital/anchore-submission:latest
+    image_name: platform-hub-api:${DRONE_COMMIT_SHA}
+    whitelist: CVE-2019-5419,CVE-2019-5420
+    when:
+      event: [push, tag]
 
   api_latest_image_to_quay:
     image: docker:17.10.0
@@ -212,7 +161,6 @@ pipeline:
       event: tag
 
 services:
-
   postgres:
     image: postgres:9.6.1
     environment:

diff --git a/platform-hub-api/.env.test b/platform-hub-api/.env.test
@@ -1,37 +1,43 @@
-#!/usr/bin/env bash
+PHUB_DB_PORT=5432
+PHUB_DB_NAME=phub_test
+PHUB_DB_USERNAME=phub
+PHUB_DB_PASSWORD=phub_password
+PHUB_ELASTICSEARCH_URL=noop
 
-# For tests only
+SECRET_KEY_BASE=689bfc57506426b2031607a154ddb79ef2681949de099d78a9f36ddd72f893be3e3553f266063ecff40d5182ac433fc839ed27d2abb78fcf174e76e9d91fa2dc
 
-export PHUB_ELASTICSEARCH_URL=noop
+GITHUB_CLIENT_ID=noop
+GITHUB_CLIENT_SECRET=noop
 
-export SECRET_KEY_BASE=$(head -c30 < /dev/urandom | base64)
+AGENT_GITHUB_TOKEN=noop
+AGENT_GITHUB_ORG=noop
+AGENT_GITHUB_ORG_MAIN_TEAM_ID=10
 
-export GITHUB_CLIENT_ID=noop
-export GITHUB_CLIENT_SECRET=noop
+AGENT_GITLAB_BASE_URL="http://noop"
+AGENT_GITLAB_TOKEN=noop
 
-export AGENT_GITHUB_TOKEN=noop
-export AGENT_GITHUB_ORG=noop
-export AGENT_GITHUB_ORG_MAIN_TEAM_ID=10
+SLACK_WEBHOOK=noop
 
-export AGENT_GITLAB_BASE_URL="http://noop"
-export AGENT_GITLAB_TOKEN=noop
+AGENT_KEYCLOAK_CLIENT_ID=noop
+AGENT_KEYCLOAK_CLIENT_SECRET=noop
+AGENT_KEYCLOAK_USERNAME=noop
+AGENT_KEYCLOAK_PASSWORD=noop
+AGENT_KEYCLOAK_BASE_URL=noop
+AGENT_KEYCLOAK_REALM=noop
 
-export SLACK_WEBHOOK=noop
+FILESTORE_S3_REGION=eu-west-2
+FILESTORE_S3_BUCKET_NAME=noop
+FILESTORE_S3_ACCESS_KEY_ID=noop
+FILESTORE_S3_SECRET_ACCESS_KEY=noop
 
-export AGENT_KEYCLOAK_CLIENT_ID=noop
-export AGENT_KEYCLOAK_CLIENT_SECRET=noop
-export AGENT_KEYCLOAK_USERNAME=noop
-export AGENT_KEYCLOAK_PASSWORD=noop
-export AGENT_KEYCLOAK_BASE_URL=noop
-export AGENT_KEYCLOAK_REALM=noop
+SQS_REGION=noop
+SQS_ACCESS_KEY_ID=noop
+SQS_SECRET_ACCESS_KEY=noop
+SQS_ECR_AGENT_TASKS_QUEUE=noop
+SQS_ECR_AGENT_RESULTS_QUEUE=noop
 
-export FILESTORE_S3_REGION=eu-west-2
-export FILESTORE_S3_BUCKET_NAME=noop
-export FILESTORE_S3_ACCESS_KEY_ID=noop
-export FILESTORE_S3_SECRET_ACCESS_KEY=noop
+APP_BASE_URL="http://localhost:3000"
+EMAIL_FROM_ADDRESS="[email protected]"
+EMAIL_MAX_TO_ADDRESSES=10
 
-export SQS_REGION=noop
-export SQS_ACCESS_KEY_ID=noop
-export SQS_SECRET_ACCESS_KEY=noop
-export SQS_ECR_AGENT_TASKS_QUEUE=noop
-export SQS_ECR_AGENT_RESULTS_QUEUE=noop
+RAILS_ENV=test
diff --git a/platform-hub-api/Dockerfile b/platform-hub-api/Dockerfile
@@ -7,7 +7,8 @@ RUN apk update && apk upgrade \
     && update-ca-certificates \
     && apk --update add \
     bash curl ruby ruby-irb ruby-rake ruby-io-console ruby-json ruby-bigdecimal libstdc++ tzdata \
-    postgresql-client \
+    postgresql-client postgresql-dev \
+    && apk --update add --virtual build_deps sudo build-base ruby-dev libc-dev libressl-dev zlib-dev \
     && echo 'gem: --no-document' > /etc/gemrc \
     && gem install bundler -v 1.16.2
 
@@ -19,12 +20,10 @@ RUN addgroup -S app \
     && chown -R app:app /app
 
 # Install deps
-RUN apk --update add --virtual build_deps sudo build-base ruby-dev libc-dev libressl-dev zlib-dev && \
-    apk --update add postgresql-dev && \
-    /bin/bash -c 'sudo -u app bundle install --jobs 20 --retry 5 --deployment --without development test --no-cache' && \
+RUN /bin/bash -c 'sudo -u app bundle install --jobs 20 --retry 5 --deployment --without development test --no-cache' && \
     apk del build_deps
 
 ENV HOME /app
 USER 1000
 
-CMD bundle exec rails s
+CMD ["bundle", "exec", "rails", "s"]
diff --git a/platform-hub-api/Gemfile b/platform-hub-api/Gemfile
@@ -2,7 +2,7 @@ source 'https://rubygems.org'
 
 ruby '2.3.8'
 
-gem 'rails', '~> 5.0.0', '>= 5.0.7.1'
+gem 'rails', '~> 5.0.0', '>= 5.0.7.2'
 gem 'pg', '~> 0.21.0'
 gem 'puma', '~> 3.0'
 gem 'jwt', '1.5.4'
@@ -33,13 +33,14 @@ gem 'commonmarker', '~> 0.18.1'
 gem 'gitlab', '~> 4.5'
 gem 'exception_notification', '~> 4.2', '>= 4.2.2'
 gem 'shoryuken', '~> 4.0', '>= 4.0.2'
+gem 'tzinfo-data', '>= 1.2019.0'
 
 group :development, :test do
   gem 'byebug', platform: :mri
   gem 'rspec-rails', '~> 3.7', '>= 3.7.2'
   gem 'rails-controller-testing', '~> 1.0'
   gem 'dotenv-rails', '~> 2.2', '>= 2.2.0'
-  gem 'factory_girl_rails', '~> 4.8'
+  gem 'factory_bot_rails', '~> 4.8'
   gem 'shoulda-matchers', '~> 3.1', '>= 3.1.2'
 end
 
@@ -52,6 +53,3 @@ group :test do
   gem 'timecop', '~> 0.9.1'
   gem 'with_model', '~> 2.0'
 end
-
-# Windows does not include zoneinfo files, so bundle the tzinfo-data gem
-gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby]