(feat!) Security and Dockerize (#1)

- RSA KeyPair Create
- Update user's public key
- Snowflake Config autogen
- Dockerize config and bot
- Add Warehouse creation
- Handle /cleanup command

.dockerignore

@@ -6,5 +6,7 @@ work
 manifest.json
 pytest.ini
 tests
-scripts
-.pytest_cache
+.pytest_cache
+**/__py_cache__
+.vscode
+.dbinfo

.env.bot.example

@@ -0,0 +1,9 @@
+
+APP_LOG_LEVEL=DEBUG
+SNOWFLAKE_DEFAULT_CONNECTION_NAME="default"
+# Bot Level
+SLACK_BOT_TOKEN=your slack bot token
+# App Level
+SLACK_APP_TOKEN=your slack app token
+# the private key path (defaulted to the one within container)
+PRIVATE_KEY_FILE_PATH=/home/me/.snowflake/snowflake_user.p8

.env.example

@@ -1,8 +1,5 @@
-
-APP_LOG_LEVEL=INFO
-SNOWFLAKE_DEFAULT_CONNECTION_NAME='trial'
-# Bot Level
-SLACK_BOT_TOKEN='your slack bot token'
-# App Level
-SLACK_APP_TOKEN='your slack app token'
-PRIVATE_KEY_FILE_PATH=your snowflake private key file path
+APP_LOG_LEVEL=DEBUG
+SNOWFLAKE_ACCOUNT=your snowflake account id
+SNOWFLAKE_USER=your snowflake user name
+SNOWFLAKE_PASSWORD=your snowflake user password
+SNOWFLAKE_ROLE=ACCOUNTADMIN

.github/workflows/slack-bot.yml

@@ -0,0 +1,92 @@
+name: Build Slack Bot
+
+on:
+    push:
+        branches: [main]
+        tags: ["v*.*.*"]
+        paths-ignore:
+            - README.md
+            - LICENSE
+            - .gitignore
+            - manifest.json
+            - pytest.ini
+            - src/tests/**
+            - .vscode
+            - .tools-version
+            - .env.bot.example
+            - .env.example
+            - .editorconfig
+            - docker-compose.yml
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: ${{ github.repository }}/slack-bot
+
+jobs:
+    build-and-push:
+        runs-on: ubuntu-latest
+        strategy:
+            matrix:
+                python-version: ["3.11"]
+                include:
+                    - python-version: "3.11"
+                      tag-suffix: "py-311"
+
+        permissions:
+            contents: read
+            packages: write
+
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@v3
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Log into GitHub Container Registry
+              uses: docker/login-action@v3
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Extract Docker metadata
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+                  tags: |
+                      type=ref,event=branch
+                      type=ref,event=pr
+                      type=semver,pattern={{version}}
+                      type=semver,pattern={{major}}.{{minor}}
+                      type=sha
+
+            - name: Generate tags
+              id: tags
+              run: |
+                  if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+                    VERSION=${GITHUB_REF#refs/tags/v}
+                    echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag-suffix }},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag-suffix }}-${VERSION}" >> $GITHUB_OUTPUT
+                  else
+                    echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag-suffix }}" >> $GITHUB_OUTPUT
+                  fi
+
+            - name: Build and push Docker image
+              uses: docker/build-push-action@v5
+              with:
+                  context: .
+                  platforms: linux/amd64,linux/arm64
+                  push: ${{ github.event_name != 'pull_request' }}
+                  tags: ${{ steps.tags.outputs.tags }}
+                  labels: ${{ steps.meta.outputs.labels }}
+                  build-args: |
+                      PYTHON_TAG=${{ matrix.tag-suffix }}
+                  cache-from: type=gha
+                  cache-to: type=gha,mode=max

.github/workflows/snow-config.yml

@@ -0,0 +1,92 @@
+name: Build Snowflake Config
+
+on:
+    push:
+        branches: [main]
+        tags: ["v*.*.*"]
+        paths-ignore:
+            - README.md
+            - LICENSE
+            - .gitignore
+            - manifest.json
+            - pytest.ini
+            - src/tests/**
+            - .vscode
+            - .tools-version
+            - .env.bot.example
+            - .env.example
+            - .editorconfig
+            - docker-compose.yml
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: ${{ github.repository }}/snow-config
+
+jobs:
+    build-and-push:
+        runs-on: ubuntu-latest
+        strategy:
+            matrix:
+                python-version: ["3.11"]
+                include:
+                    - python-version: "3.11"
+                      tag-suffix: "py-311"
+
+        permissions:
+            contents: read
+            packages: write
+
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@v3
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Log into GitHub Container Registry
+              uses: docker/login-action@v3
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Extract Docker metadata
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+                  tags: |
+                      type=ref,event=branch
+                      type=ref,event=pr
+                      type=semver,pattern={{version}}
+                      type=semver,pattern={{major}}.{{minor}}
+                      type=sha
+
+            - name: Generate tags
+              id: tags
+              run: |
+                  if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+                    VERSION=${GITHUB_REF#refs/tags/v}
+                    echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag-suffix }},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag-suffix }}-${VERSION}" >> $GITHUB_OUTPUT
+                  else
+                    echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.tag-suffix }}" >> $GITHUB_OUTPUT
+                  fi
+
+            - name: Build and push Docker image
+              uses: docker/build-push-action@v5
+              with:
+                  context: .
+                  platforms: linux/amd64,linux/arm64
+                  push: ${{ github.event_name != 'pull_request' }}
+                  tags: ${{ steps.tags.outputs.tags }}
+                  labels: ${{ steps.meta.outputs.labels }}
+                  build-args: |
+                      PYTHON_TAG=${{ matrix.tag-suffix }}
+                  cache-from: type=gha
+                  cache-to: type=gha,mode=max

.gitignore

@@ -3,8 +3,13 @@
 .direnv
 .cache
 **/.dbinfo
-data/**
-!data/*.j2
+src/templates/*.yaml
 !.env.example
+!.env.bot.example
 work
-.config
+.config
+keys
+**/*.p8
+**/*.pub
+!scripts/**
+!scripts/bin/**

Dockerfile

@@ -1,17 +1,15 @@
-FROM python:3.11-alpine
+ARG PYTHON_TAG=311
+FROM ghcr.io/kameshsampath/snow-dev:${PYTHON_TAG}
 
-RUN apk add g++ gcc python3-dev musl-dev linux-headers \
-    && pip install --upgrade pip
+USER me
 
-RUN adduser -D demo
-USER demo
-WORKDIR /home/demo
+WORKDIR $HOME
 
-COPY --chown=demo:demo requirements.txt requirements.txt
-RUN pip install --user -r requirements.txt
+ADD --chown=me:me src/ /home/me/app/
 
-ENV PATH="/home/demo/.local/bin:${PATH}"
+ADD --chown=me:me requirements.txt /home/me/app/requirements.txt
+ADD --chown=me:me scripts/bin/run.app /home/me/.local/bin/run
+ADD --chown=me:me app.py /home/me/.local/bin/slack-bot
+ADD --chown=me:me scripts/bin/wait_for_config /home/me/.local/bin/wait_for_config
 
-COPY --chown=demo:demo . .
-
-CMD ["python","app.py"]
+RUN pip install --no-cache --user -r /home/me/app/requirements.txt

Dockerfile.config

@@ -0,0 +1,12 @@
+ARG PYTHON_TAG=311
+FROM ghcr.io/kameshsampath/snow-dev:${PYTHON_TAG}
+
+USER me
+
+WORKDIR /home/me
+
+ADD --chown=me:me src/ /home/me/app/
+ADD --chown=me:me scripts/bin/run /home/me/.local/bin/run
+ADD --chown=me:me scripts/bin/user_key_setup /home/me/.local/bin/user_key_setup
+
+RUN pip install --no-cache --user jinja2 snowflake snowflake-snowpark-python