ci: address OSS scorecard warnings

* remediate the `Token-Permissions` warning/low score by moving the F5 CLA GH Action permissions around * remediate the `Pinned-Dependencies` warning/low score by using specific Docker image SHAs and adding Docker image updates to Dependabot * hopefully remediate the `Vulnerabilities` warning/low score by recreating `package-lock.json`
nginxinc · May 6, 2024 · ba9e0b3 · ba9e0b3
1 parent 62caea4
commit ba9e0b3
Show file tree

Hide file tree

Showing 12 changed files with 345 additions and 251 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,6 +1,12 @@
 ---
 version: 2
 updates:
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "00:00"
   - package-ecosystem: github-actions
     directory: /
     schedule:

diff --git a/.github/workflows/f5-cla.yml b/.github/workflows/f5-cla.yml
@@ -1,18 +1,19 @@
+---
 name: F5 CLA
 on:
   issue_comment:
     types: [created]
   pull_request_target:
     types: [opened, closed, synchronize]
-
-permissions:
-  actions: write
-  pull-requests: write
-  statuses: write
-
+permissions: read-all
 jobs:
   f5-cla:
+    name: F5 CLA
     runs-on: ubuntu-22.04
+    permissions:
+      actions: write
+      pull-requests: write
+      statuses: write
     steps:
       - name: Run F5 Contributor License Agreement (CLA) assistant
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have hereby read the F5 CLA and agree to its terms') || github.event_name == 'pull_request_target'
@@ -31,7 +32,7 @@ jobs:
           remote-repository-name: 'f5-cla-data'
           path-to-signatures: 'signatures/beta/signatures.json'
           # Comma separated list of usernames for maintainers or any other individuals who should not be prompted for a CLA.
-          allowlist: 4141done, dekobon, bot*
+          allowlist: 4141done, alessfg, dekobon, bot*
           # Do not lock PRs after a merge.
           lock-pullrequest-aftermerge: false
         env:

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -1,5 +1,5 @@
 ---
-name: CI
+name: NGINX S3 Gateway CI/CD
 on:
   push:
     branches: [main]

diff --git a/Dockerfile.buildkit.plus b/Dockerfile.buildkit.plus
@@ -1,4 +1,4 @@
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:155280b00ee0133250f7159b567a07d7cd03b1645714c3a7458b2287b0ca83cb
 
 ENV NGINX_PLUS_VERSION   30-2
 ENV NGINX_VERSION        1.25.1

diff --git a/Dockerfile.latest-njs b/Dockerfile.latest-njs
@@ -1,7 +1,7 @@
 # This container image removes the existing njs package from the inherited image
 # (which could be OSS NGINX or NGINX Plus), builds njs from the latest
 # source, and installs it.
-FROM nginx-s3-gateway
+FROM nginxinc/nginx-s3-gateway@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4
 
 RUN set -eux \
     export DEBIAN_FRONTEND=noninteractive;  \

diff --git a/Dockerfile.oss b/Dockerfile.oss
@@ -1,7 +1,7 @@
-FROM nginx:1.25.3
+FROM nginx:1.25.5@sha256:711cc227e3c4181ab27cde13cf662f6dd1d06d16b3344f871c6d04cbff22f6f8
 
-ENV NGINX_VERSION "1.25.3"
-ENV NJS_VERSION   "0.8.2"
+ENV NGINX_VERSION "1.25.5"
+ENV NJS_VERSION   "0.8.4"
 
 ENV PROXY_CACHE_MAX_SIZE "10g"
 ENV PROXY_CACHE_INACTIVE "60m"

diff --git a/Dockerfile.plus b/Dockerfile.plus
@@ -1,10 +1,10 @@
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:155280b00ee0133250f7159b567a07d7cd03b1645714c3a7458b2287b0ca83cb
 
 ENV NGINX_PLUS_VERSION   30-2
 ENV NGINX_VERSION        1.25.1
 ENV NJS_VERSION          30+0.8.0-1
 ENV XSLT_VERSION         30-1
- 
+
 ENV PROXY_CACHE_MAX_SIZE "10g"
 ENV PROXY_CACHE_INACTIVE "60m"
 ENV PROXY_CACHE_SLICE_SIZE "1m"

diff --git a/Dockerfile.unprivileged b/Dockerfile.unprivileged
@@ -3,7 +3,7 @@
 # to allow running NGINX S3 Gateway as a non root user.
 # Steps are based on the official unprivileged container:
 # https://github.com/nginxinc/docker-nginx-unprivileged/blob/main/Dockerfile-debian.template
-FROM nginx-s3-gateway
+FROM nginxinc/nginx-s3-gateway@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4
 
 # Implement changes required to run NGINX as an unprivileged user
 RUN sed -i "/^server {/a \    listen       8080;" /etc/nginx/templates/default.conf.template \

diff --git a/examples/brotli-compression/Dockerfile.oss b/examples/brotli-compression/Dockerfile.oss
@@ -1,4 +1,4 @@
-FROM nginxinc/nginx-s3-gateway
+FROM nginxinc/nginx-s3-gateway@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4
 
 ENV BROTLI_VERSION "v1.0.0rc"
 

diff --git a/examples/gzip-compression/Dockerfile.oss b/examples/gzip-compression/Dockerfile.oss
@@ -1,3 +1,3 @@
-FROM nginxinc/nginx-s3-gateway
+FROM nginxinc/nginx-s3-gateway@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4
 
 COPY etc/nginx/conf.d /etc/nginx/conf.d
diff --git a/examples/modsecurity/Dockerfile.oss b/examples/modsecurity/Dockerfile.oss
@@ -1,4 +1,4 @@
-FROM nginxinc/nginx-s3-gateway
+FROM nginxinc/nginx-s3-gateway@sha256:8aa48324479b3653b5936183cc97f2ca1aa9078d229042f1bca357834bd906f4
 
 ENV MODSECURITY_VERSION "v1.0.1"
 ENV OWASP_RULESET_VERSION "v3.3.0"