feat(image): add linting

.github/workflows/test.yml

@@ -10,12 +10,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - run: go generate -tags tools tools/tools.go
-
       - uses: actions/setup-go@v5
         with:
           go-version: '1.20'
           cache: false
+
+      - run: go generate -tags tools tools/tools.go
 
       - name: go get
         run: go get ./...

.github/workflows/trivy.yml

@@ -0,0 +1,46 @@
+name: image_scan
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.20'
+          cache: false
+
+      - run: go generate -tags tools tools/tools.go
+
+      - name: go get
+        run: go get ./...
+
+      - name: go build
+        run: go build -o vault-kubernetes-kms cmd/main.go
+
+      - uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile
+
+      - name: Build an image from Dockerfile
+        run: |
+          docker build -t docker.io/falcosuessgott/vault-kubernetes-kms:${{ github.sha }} .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'docker.io/falcosuessgott/vault-kubernetes-kms:${{ github.sha }}'
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-results.sarif

.pre-commit-config.yaml

@@ -1,11 +1,10 @@
 repos:
   - repo: https://github.com/tekwizely/pre-commit-golang
-    rev: v1.0.0-rc.1
+    rev: master
     hooks:
-      - id: go-build-mod
-      - id: go-test-mod
-      - id: go-vet-mod
-      - id: go-staticcheck-mod
+      - id: go-build-repo
+      - id: go-test-repo
+      - id: go-staticcheck-repo
       - id: go-fmt
       - id: go-fumpt
       - id: go-imports

Dockerfile

@@ -1,5 +1,13 @@
-FROM alpine:3.19
+FROM golang:1.20 as builder 
+WORKDIR /usr/src/vault-kubernetes-kms
+COPY go.mod go.sum ./
+RUN go mod download && go mod verify
+COPY . . 
+RUN GO111MODULE=off CGO_ENABLED=0 GOOS=linux go build -v -o vault-kubernetes-kms cmd/main.go
 
-COPY vault-kubernetes-kms /usr/bin/vault-kubernetes-kms
+# https://github.com/GoogleContainerTools/distroless/issues/1360#issuecomment-1646667145
+FROM gcr.io/distroless/static-debian12@sha256:4a2c1a51ae5e10ec4758a0f981be3ce5d6ac55445828463fce8dff3a355e0b75
+WORKDIR /
+COPY --from=builder /usr/src/vault-kubernetes-kms .
 
-ENTRYPOINT ["/usr/bin/vault-kubernetes-kms"]
+ENTRYPOINT ["/vault-kubernetes-kms"]

TODOS.md

@@ -9,4 +9,5 @@
 * [ ] e2e
 * [ ] health check
 * [ ] better docker image
-* [ ] simple arch image
+* [ ] simple arch image
+* [ ] sign the images using cosign