Skip to content

Commit 36677e1

Browse files
anthony-nhsanthony-nhs
authored
New: [AEA-0000] - Use pre-built devcontainer (#66)
## Summary - Routine Change ### Details - use pre-built devcontainer in visual studio code - new workflow to run quality checks in pre-built devcontainer - new workflow to run tag-release in pre-built devcontainer - new workflow to verify attestation of pre-built devcontainer - remove licence scan scripts as handled by trivy now - remove asdf files as not needed anymore
1 parent 184a7ea commit 36677e1

16 files changed

+1083
-634
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 10 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,14 @@
1-
FROM mcr.microsoft.com/devcontainers/base:ubuntu
2-
3-
# provide DOCKER_GID via build args if you need to force group id to match host
4-
ARG DOCKER_GID
1+
ARG IMAGE_NAME=node_24_python_3_14
2+
ARG IMAGE_VERSION=latest
3+
FROM ghcr.io/nhsdigital/eps-devcontainers/${IMAGE_NAME}:${IMAGE_VERSION}
54

5+
USER root
66
# specify DOCKER_GID to force container docker group id to match host
77
RUN if [ -n "${DOCKER_GID}" ]; then \
8-
if ! getent group docker; then \
9-
groupadd -g ${DOCKER_GID} docker; \
10-
else \
11-
groupmod -g ${DOCKER_GID} docker; \
12-
fi && \
13-
usermod -aG docker vscode; \
8+
if ! getent group docker; then \
9+
groupadd -g ${DOCKER_GID} docker; \
10+
else \
11+
groupmod -g ${DOCKER_GID} docker; \
12+
fi && \
13+
usermod -aG docker vscode; \
1414
fi
15-
16-
# Anticipate and resolve potential permission issues with apt
17-
RUN mkdir -p /tmp && chmod 1777 /tmp
18-
19-
RUN apt-get update \
20-
&& export DEBIAN_FRONTEND=noninteractive \
21-
&& apt-get -y dist-upgrade \
22-
&& apt-get -y install --no-install-recommends htop vim curl git build-essential \
23-
libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev libbz2-dev \
24-
zlib1g-dev unixodbc unixodbc-dev libsecret-1-0 libsecret-1-dev libsqlite3-dev \
25-
jq apt-transport-https ca-certificates gnupg-agent \
26-
software-properties-common bash-completion python3-pip make libbz2-dev \
27-
libreadline-dev libsqlite3-dev wget llvm libncurses5-dev libncursesw5-dev \
28-
xz-utils tk-dev liblzma-dev netcat-traditional libyaml-dev
29-
30-
USER vscode
31-
32-
# Install ASDF
33-
RUN git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.11.3 && \
34-
echo '. $HOME/.asdf/asdf.sh' >> ~/.bashrc && \
35-
echo '. $HOME/.asdf/completions/asdf.bash' >> ~/.bashrc
36-
37-
ENV PATH="$PATH:/home/vscode/.asdf/bin/:/workspaces/eps-prescription-tracker-ui/node_modules/.bin:/workspaces/eps-common-workflows/.venv/bin"
38-
39-
# Install ASDF plugins#
40-
RUN asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git && \
41-
asdf plugin add actionlint && \
42-
asdf plugin add shellcheck https://github.com/luizm/asdf-shellcheck.git && \
43-
asdf plugin add poetry https://github.com/asdf-community/asdf-poetry.git && \
44-
asdf plugin add python
45-
46-
WORKDIR /workspaces/eps-common-workflows
47-
48-
ADD .tool-versions /workspaces/eps-common-workflows/.tool-versions
49-
ADD .tool-versions /home/vscode/.tool-versions
50-
51-
RUN asdf install python && \
52-
asdf install && \
53-
asdf reshim nodejs

‎.devcontainer/devcontainer.json‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,18 @@
1-
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
2-
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
31
{
4-
"name": "Ubuntu",
5-
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
2+
"name": "eps-common-workflows",
63
"build": {
74
"dockerfile": "Dockerfile",
85
"context": "..",
96
"args": {
10-
"DOCKER_GID": "${env:DOCKER_GID:}"
11-
}
7+
"DOCKER_GID": "${env:DOCKER_GID:}",
8+
"IMAGE_NAME": "node_24_python_3_14",
9+
"IMAGE_VERSION": "v1.0.6",
10+
"USER_UID": "${localEnv:USER_ID:}",
11+
"USER_GID": "${localEnv:GROUP_ID:}"
12+
},
13+
"updateRemoteUserUID": false
1214
},
15+
"postAttachCommand": "git-secrets --register-aws; git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt",
1316
"mounts": [
1417
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
1518
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",
@@ -20,15 +23,7 @@
2023
"remoteEnv": {
2124
"LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}"
2225
},
23-
"postAttachCommand": "make install && docker build -f /workspaces/eps-common-workflows/dockerfiles/nhsd-git-secrets.dockerfile -t git-secrets . && pre-commit install --install-hooks -f",
24-
"features": {
25-
"ghcr.io/devcontainers/features/github-cli:1": {},
26-
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
27-
"version": "latest",
28-
"moby": "true",
29-
"installDockerBuildx": "true"
30-
}
31-
},
26+
"features": {},
3227
"customizations": {
3328
"vscode": {
3429
"extensions": [

‎.github/workflows/pull_request.yml‎

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -16,36 +16,45 @@ jobs:
1616
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
1717
pr_title_format_check:
1818
uses: ./.github/workflows/pr_title_check.yml
19-
get_asdf_version:
19+
get_config_values:
2020
runs-on: ubuntu-22.04
2121
outputs:
22-
asdf_version: ${{ steps.asdf-version.outputs.version }}
2322
tag_format: ${{ steps.load-config.outputs.TAG_FORMAT }}
23+
devcontainer_version: ${{ steps.load-config.outputs.DEVCONTAINER_VERSION }}
24+
devcontainer_image: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE }}
2425
steps:
2526
- name: Checkout code
2627
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2728

28-
- name: Get asdf version
29-
id: asdf-version
30-
run: echo "version=$(awk '!/^#/ && NF {print $1; exit}' .tool-versions.asdf)" >> "$GITHUB_OUTPUT"
3129
- name: Load config value
3230
id: load-config
3331
run: |
3432
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
35-
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
33+
DEVCONTAINER_IMAGE=$(jq -r '.build.args.IMAGE_NAME' .devcontainer/devcontainer.json)
34+
DEVCONTAINER_VERSION=$(jq -r '.build.args.IMAGE_VERSION' .devcontainer/devcontainer.json)
35+
{
36+
echo "TAG_FORMAT=$TAG_FORMAT"
37+
echo "DEVCONTAINER_IMAGE=$DEVCONTAINER_IMAGE"
38+
echo "DEVCONTAINER_VERSION=$DEVCONTAINER_VERSION"
39+
} >> "$GITHUB_OUTPUT"
3640
quality_checks:
37-
uses: ./.github/workflows/quality-checks.yml
38-
needs: [get_asdf_version]
41+
uses: ./.github/workflows/quality-checks-devcontainer.yml
42+
needs: [get_config_values]
3943
with:
40-
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
44+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
4145
secrets:
4246
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
4347
tag_release:
44-
needs: [quality_checks, get_asdf_version]
45-
uses: ./.github/workflows/tag-release.yml
48+
needs: [quality_checks, get_config_values]
49+
uses: ./.github/workflows/tag-release-devcontainer.yml
50+
permissions:
51+
contents: read
52+
packages: read
53+
attestations: read
4654
with:
4755
dry_run: true
48-
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
56+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
4957
branch_name: ${{ github.event.pull_request.head.ref }}
50-
tag_format: ${{ needs.get_asdf_version.outputs.tag_format }}
58+
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
59+
verify_published_from_main_image: false
5160
secrets: inherit

0 commit comments

Comments
 (0)