Skip to content

Commit ff7ed4b

Browse files
lukehindslukehinds
authored
Introduce Official Bandit Images (#1088)
* Introduce Official Bandit Images Folks are using various bandit images kindly built by others, but we should really start providing one of our that builds directly from source (the others use pip install). Should a different container image be subjected to some sort of attack (maintainer take over), this could lead to some serious problems for those using Bandit. This PR includes an action to build, publish and sign the image using sigstore cosign. This way (should they wish) users can verify the source of origin for these images were the offcial repo. You can see an example of this below, where I tested the action in my own test fork (bandit-test): https://search.sigstore.dev/?logIndex=61918446 Signed-off-by: Luke Hinds <[email protected]> * Update tags for other actions Signed-off-by: Luke Hinds <[email protected]> * Fix TOX Signed-off-by: Luke Hinds <[email protected]> * Single python release and review points Signed-off-by: Luke Hinds <[email protected]> * Single python release and review points Signed-off-by: Luke Hinds <[email protected]> * Remove arch from container tag Signed-off-by: Luke Hinds <[email protected]> * Remove arch from container tag Signed-off-by: Luke Hinds <[email protected]> * Missed text referencing arch tag Signed-off-by: Luke Hinds <[email protected]> * Add workflow dispatch * On schedule or dispatch, build from last release * Pin to digests --------- Signed-off-by: Luke Hinds <[email protected]>
1 parent 99ddf6b commit ff7ed4b

File tree

3 files changed

+113
-0
lines changed

3 files changed

+113
-0
lines changed

‎.github/workflows/build-publish-image.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Build and Publish Bandit Images
2+
3+
on:
4+
release:
5+
types: [created]
6+
schedule:
7+
- cron: '0 0 * * 0' # Every Sunday at midnight
8+
workflow_dispatch:
9+
10+
jobs:
11+
build-and-publish:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
packages: write
16+
id-token: write
17+
18+
steps:
19+
20+
- name: Get latest release tag
21+
if: github.event_name != 'release'
22+
id: get-latest-tag
23+
run: |
24+
TAG=$(curl -s https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r .tag_name)
25+
echo "Latest tag is $TAG"
26+
echo "RELEASE_TAG=$TAG" >> $GITHUB_ENV
27+
28+
- name: Check out the repo
29+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
30+
with:
31+
ref: ${{ github.event_name == 'release' && github.ref || env.RELEASE_TAG }}
32+
33+
- name: Set up Docker Buildx
34+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3
35+
36+
- name: Log in to GitHub Container Registry
37+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
38+
with:
39+
registry: ghcr.io
40+
username: ${{ github.actor }}
41+
password: ${{ secrets.GITHUB_TOKEN }}
42+
43+
- name: Install Cosign
44+
uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
45+
with:
46+
cosign-release: 'v2.2.2'
47+
48+
- name: Build and push Docker image
49+
id: build-and-push
50+
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5
51+
with:
52+
context: .
53+
file: ./docker/Dockerfile
54+
push: true
55+
tags: ghcr.io/${{ github.repository }}/bandit:latest
56+
platforms: linux/amd64, linux/arm64, linux/arm/v7, linux/arm/v8
57+
58+
- name: Sign the image
59+
env:
60+
TAGS: ghcr.io/${{ github.repository }}/bandit:latest
61+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
62+
run: |
63+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎README.rst‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,3 +83,37 @@ https://greentreesnakes.readthedocs.org/en/latest/
8383
Documentation of the various types of AST nodes that Bandit currently covers
8484
or could be extended to cover:
8585
https://greentreesnakes.readthedocs.org/en/latest/nodes.html
86+
87+
Container Images
88+
----------------
89+
90+
Bandit is available as a container image, built within the bandit repository
91+
using GitHub Actions. The image is available on ghcr.io:
92+
93+
```bash
94+
docker pull ghcr.io/pycqa/bandit/bandit
95+
```
96+
97+
The image is built for the following architectures:
98+
99+
* amd64
100+
* arm64
101+
* armv7
102+
* armv8
103+
104+
To pull a specific architecture, use the following format:
105+
106+
```bash
107+
docker pull --platform=<architecture> ghcr.io/pycqa/bandit/bandit:latest
108+
```
109+
110+
Every image is signed with sigstore cosign and it is possible to verify the
111+
source of origin using the following cosign command:
112+
113+
```bash
114+
cosign verify ghcr.io/pycqa/bandit/bandit:py39-amd64 \
115+
--certificate-identity https://github.com/pycqa/bandit/.github/workflows/build-publish-image.yml@refs/tags/<version> \
116+
--certificate-oidc-issuer https://token.actions.githubusercontent.com
117+
```
118+
119+
Where `<version>` is the release version of Bandit.

‎docker/Dockerfile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
FROM python:3.12-alpine
2+
3+
# Install Git (required for pbr versioning)
4+
RUN apk add --no-cache git
5+
6+
# Copy the source code into the container
7+
COPY . /bandit
8+
9+
# Set the working directory
10+
WORKDIR /bandit
11+
12+
# Install Bandit from the source code using pip
13+
RUN pip install .
14+
15+
# Define entrypoint and default command
16+
ENTRYPOINT ["bandit"]

0 commit comments

Comments
 (0)