Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deploy 2024-05-21 #467

Merged
merged 14 commits into from
May 21, 2024
Merged

Deploy 2024-05-21 #467

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
1b5c8ca
chore(ci): Switch to general-task and registry-image for CI jobs
apburnes Mar 12, 2024
e7d3cc5
Merge pull request #457 from cloud-gov/chore-ci-update-general-task-r…
apburnes Mar 12, 2024
d121aeb
feat: save build container metrics to API
drewbo Apr 29, 2024
4bf4ddb
Merge pull request #459 from cloud-gov/feat-build-metrics
drewbo May 6, 2024
c947af3
chore: Add dependency auditing with pip-audit (#458)
svenaas May 6, 2024
6ad6aec
Merge pull request #460 from cloud-gov/458-add-dependency-auditing
svenaas May 9, 2024
a19b4de
fix: remove puts to git-resource in ci pipeline
drewbo May 9, 2024
1957031
Merge pull request #462 from cloud-gov/fix-audit-ci
drewbo May 9, 2024
15eac35
chore: container hardening
drewbo May 10, 2024
ef95cc9
Merge pull request #463 from cloud-gov/chore-more-container-hardening
drewbo May 10, 2024
b3911b7
chore: Enable Dependabot security scanning (#458)
svenaas May 13, 2024
36fb430
Merge pull request #464 from cloud-gov/458-enable-dependabot-security…
svenaas May 14, 2024
7d7b17e
chore: Add decrypt to build site params
apburnes May 14, 2024
206740e
Merge pull request #465 from cloud-gov/chore-decrypt-params
apburnes May 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
chore: Add dependency auditing with pip-audit (#458)
  • Loading branch information
@svenaas
svenaas committed May 9, 2024
commit c947af3cba69947597f49e2e82fc05efea7d1ffa
59 changes: 59 additions & 0 deletions ci/pipeline-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,65 @@ jobs:
username: ((slack-username))
icon_url: ((slack-icon-url))

- name: audit-dependencies
plan:
- get: src
resource: pr-((git-branch))
trigger: true
passed: [set-pipeline]

- put: src
resource: pr-((git-branch))
params:
path: src
status: pending
base_context: concourse
context: audit-dependencies

- task: pip-audit
config:
<<: *python-image
inputs: [name: src]
outputs: [name: src]
run:
dir: src
path: ci/tasks/pip-audit.sh

on_failure:
in_parallel:
- put: src
resource: pr-((git-branch))
params:
path: src
status: failure
base_context: concourse
context: audit-dependencies
- put: slack
params:
text: |
:x: FAILED: pages build container dependency audit on ((git-branch))
<$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME?vars.deploy-env="((deploy-env))"&vars.git-branch="((git-branch))"|View build details>
channel: ((slack-channel))
username: ((slack-username))
icon_url: ((slack-icon-url))

on_success:
in_parallel:
- put: src
resource: pr-((git-branch))
params:
path: src
status: success
base_context: concourse
context: audit-dependencies
- put: slack
params:
text: |
:white_check_mark: SUCCESS: Successfully passed pages build container dependency audit on ((git-branch))
channel: ((slack-channel))
username: ((slack-username))
icon_url: ((slack-icon-url))

############################
# RESOURCES

Expand Down
59 changes: 59 additions & 0 deletions ci/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,65 @@ jobs:
username: ((slack-username))
icon_url: ((slack-icon-url))

- name: audit-dependencies
plan:
- get: src
resource: src-((deploy-env))
trigger: true
passed: [set-pipeline]

- put: src
resource: src-((deploy-env))
params:
path: src
status: pending
base_context: concourse
context: audit-dependencies

- task: pip-audit
config:
<<: *python-image
inputs: [name: src]
outputs: [name: src]
run:
dir: src
path: ci/tasks/pip-audit.sh

on_failure:
in_parallel:
- put: src
resource: src-((deploy-env))
params:
path: src
status: failure
base_context: concourse
context: audit-dependencies
- put: slack
params:
text: |
:x: FAILED: pages build container dependency audit on ((deploy-env))
<$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME?vars.deploy-env="((deploy-env))"&vars.git-branch="((git-branch))"|View build details>
channel: ((slack-channel))
username: ((slack-username))
icon_url: ((slack-icon-url))

on_success:
in_parallel:
- put: src
resource: src-((deploy-env))
params:
path: src
status: success
base_context: concourse
context: audit-dependencies
- put: slack
params:
text: |
:white_check_mark: SUCCESS: Successfully passed pages build container dependency audit on ((deploy-env))
channel: ((slack-channel))
username: ((slack-username))
icon_url: ((slack-icon-url))

############################
# RESOURCES

Expand Down
9 changes: 9 additions & 0 deletions ci/tasks/pip-audit.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
#!/usr/bin/env bash

set -euo pipefail

pip install pip-audit

python3 -m pip_audit -r ./requirements.txt

exit $status
1 change: 1 addition & 0 deletions requirements-dev.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
bandit>=1.0,<2.0
flake8==3.8.3
moto==5.0.1
pip-audit==2.7.3
pyfakefs==4.0.2
pyflakes==2.2.0
pylint==2.5.3
Expand Down
Loading