chore(build): update docker image version and add Trivy scan for vuln… #2064
Conversation
WalkthroughThis pull request updates the Dockerfile and Makefile. In the Dockerfile, the version of the Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant M as Makefile
participant TS as Trivy Scan
participant C as Cleanup
Dev->>M: Run "release" target
M->>M: Execute "format", "test", and "security-scan"
M->>TS: Initiate "trivy-scan"
TS->>M: Build Docker image and run vulnerability scan
TS->>M: Generate JSON report
M->>C: Execute "clean" (remove report and Docker image)
C-->>M: Cleanup complete
M-->>Dev: Release process finished
sequenceDiagram
participant Dev as Developer
participant M as Makefile
participant DC as Docker Compose
Dev->>M: Run "compose-up" or "compose-up-integration-test"
M->>DC: Start services via Docker Compose
Dev->>DC: Interact with running containers
Dev->>M: Run "compose-down" to stop services
DC-->>M: Teardown complete
M-->>Dev: Docker Compose cycle finished
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
Makefile (1)
73-77: Implement "trivy-scan" Target for Vulnerability Scanning
Thetrivy-scantarget builds the Docker image and then performs a vulnerability scan using Trivy, outputting results totrivy-report.json. This is an important enhancement for ensuring that the Docker images remain free of known vulnerabilities.Consider parameterizing the Docker image tag (e.g., using a variable) to reduce duplication and improve maintainability.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
Dockerfile(1 hunks)Makefile(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: Test with Coverage
- GitHub Check: Analyze (go)
- GitHub Check: Test with Coverage
🔇 Additional comments (6)
Dockerfile (1)
8-8: Update grpc-health-probe Version
The COPY command on line 8 now references versionv0.4.37of the grpc-health-probe binary instead of the previousv0.4.28. This update is aligned with the PR objectives to improve security and reliability.Makefile (5)
12-15: Add Docker Compose "compose-up" Target
A new.PHONY: compose-uptarget has been added to rundocker-compose up --build. This improves developer ergonomics by providing a simple command to bring up the services.
16-19: Introduce "compose-up-integration-test" Target
The addition of thecompose-up-integration-testtarget, which includes integration testing parameters (--abort-on-container-exit --exit-code-from integration), is a solid extension for automated testing scenarios.
20-23: Add "compose-down" Target for Cleanup
The newcompose-downtarget provides a convenient way to tear down Docker Compose with the--remove-orphansflag. This ensures that stray containers are cleaned up appropriately.
88-89: Enhance Cleanup in the "clean" Target
The updates in thecleantarget now remove bothcovprofile,coverage.html, andtrivy-report.json, as well as force-remove the Docker imagepermify-image. This helps in keeping the build environment tidy and free from artifacts that might affect subsequent builds.
97-97: Include Vulnerability Scan in the "release" Target
Thereleasetarget now includestrivy-scanamong its dependencies. This ensures that the vulnerability scan is part of the release process, contributing to a more secure build by preventing releases with known issues.
…erabilities
Summary by CodeRabbit