From 588d2d7249020421596de9fc9391b0b344498f57 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Apr 2026 18:16:36 +0000 Subject: [PATCH 1/3] fix(dev.sh): implement getopts argument parsing and semver validation Replace positional argument parsing with getopts, add -a/-t/-i flags, and validate AWS and Terraform versions against semver regex before use. https://claude.ai/code/session_01RsmDFm6w4jVXwvzmRd9BCv --- dev.sh | 51 +++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 10 deletions(-) diff --git a/dev.sh b/dev.sh index c9f83f4..461a9fd 100755 --- a/dev.sh +++ b/dev.sh @@ -1,27 +1,58 @@ #!/usr/bin/env bash -set -eo pipefail +set -euo pipefail -# FIXME: use getopts function to parse aguments -# FIXME: if provided, both TF and AWS CLI semvers should be regex-validated +trap 'echo "Error: script failed at line ${LINENO}" >&2' ERR + +usage() { + echo "Usage: $0 [-a AWS_CLI_VERSION] [-t TF_VERSION] [-i IMAGE_TAG]" + echo " -a AWS CLI version (default: latest from supported_versions.json)" + echo " -t Terraform version (default: latest from supported_versions.json)" + echo " -i Image tag (default: dev)" + exit 1 +} + +while getopts "a:t:i:h" opt; do + case ${opt} in + a) AWS_VERSION="${OPTARG}" ;; + t) TF_VERSION="${OPTARG}" ;; + i) IMAGE_TAG="${OPTARG}" ;; + h) usage ;; + *) usage ;; + esac +done # Set AWS and TF CLI to latest supported versions if not specified -[[ -n $1 ]] && AWS_VERSION=$1 || AWS_VERSION=$(jq -r '.awscli_versions | sort | .[-1]' supported_versions.json) -[[ -n $2 ]] && TF_VERSION=$2 || TF_VERSION=$(jq -r '.tf_versions | sort | .[-1]' supported_versions.json) +AWS_VERSION="${AWS_VERSION:-$(jq -r '.awscli_versions | sort | .[-1]' supported_versions.json)}" +TF_VERSION="${TF_VERSION:-$(jq -r '.tf_versions | sort | .[-1]' supported_versions.json)}" # Set image name and tag (dev if not specified) IMAGE_NAME="zenika/terraform-aws-cli" -[[ -n $3 ]] && IMAGE_TAG=$3 || IMAGE_TAG="dev" +IMAGE_TAG="${IMAGE_TAG:-dev}" + +SEMVER_REGEX="^[0-9]+\.[0-9]+\.[0-9]+$" + +validate_semver() { + local version="$1" + local name="$2" + if [[ ! "${version}" =~ ${SEMVER_REGEX} ]]; then + echo "Error: ${name} '${version}' is not a valid semver (expected X.Y.Z)" + exit 1 + fi +} + +validate_semver "${AWS_VERSION}" "AWS_CLI_VERSION" +validate_semver "${TF_VERSION}" "TERRAFORM_VERSION" -# Set platform for Hadolint image (only linux/arm64 or linux/arm64 supported) -PLATEFORM="linux/$(uname -m)" +# Set platform for Hadolint image (only linux/amd64 or linux/arm64 supported) +PLATFORM="linux/$(uname -m)" # Lint Dockerfile echo "Linting Dockerfile..." docker container run --rm --interactive \ --volume "${PWD}":/data \ --workdir /data \ - --platform "${PLATEFORM}" \ + --platform "${PLATFORM}" \ hadolint/hadolint:2.12.0-alpine /bin/hadolint \ --config hadolint.yaml Dockerfile echo "Lint Successful!" @@ -30,7 +61,7 @@ echo "Lint Successful!" echo "Building images with AWS_CLI_VERSION=${AWS_VERSION} and TERRAFORM_VERSION=${TF_VERSION}..." docker buildx build \ --progress plain \ - --platform "${PLATEFORM}" \ + --platform "${PLATFORM}" \ --build-arg AWS_CLI_VERSION="${AWS_VERSION}" \ --build-arg TERRAFORM_VERSION="${TF_VERSION}" \ --tag ${IMAGE_NAME}:${IMAGE_TAG} . From 960633731627f80b7e5ebdaf3d1481bd3bfca732 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Apr 2026 18:16:46 +0000 Subject: [PATCH 2/3] refactor(dockerfile): consolidate apt-get install layers in build stages Merge separate RUN apt-get install calls in the terraform and aws-cli stages into a single RUN with apt-get clean to reduce image layer count. https://claude.ai/code/session_01RsmDFm6w4jVXwvzmRd9BCv --- Dockerfile | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/Dockerfile b/Dockerfile index 2af6f55..9c42882 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,12 +8,14 @@ ARG DEBIAN_FRONTEND=noninteractive FROM debian:${DEBIAN_VERSION} as terraform ARG TARGETARCH ARG TERRAFORM_VERSION -RUN apt-get update -# RUN apt-get install --no-install-recommends -y libcurl4=7.74.0-1.3+deb11u7 -RUN apt-get install --no-install-recommends -y ca-certificates=20230311 -RUN apt-get install --no-install-recommends -y curl=7.88.1-10+deb12u4 -RUN apt-get install --no-install-recommends -y gnupg=2.2.40-1.1 -RUN apt-get install --no-install-recommends -y unzip=6.0-28 +RUN apt-get update \ + && apt-get install --no-install-recommends -y \ + ca-certificates=20230311 \ + curl=7.88.1-10+deb12u4 \ + gnupg=2.2.40-1.1 \ + unzip=6.0-28 \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* WORKDIR /workspace RUN curl --silent --show-error --fail --remote-name https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${TARGETARCH}.zip COPY security/hashicorp.asc ./ @@ -26,13 +28,16 @@ RUN unzip -j terraform_${TERRAFORM_VERSION}_linux_${TARGETARCH}.zip # Install AWS CLI version 2 FROM debian:${DEBIAN_VERSION} as aws-cli ARG AWS_CLI_VERSION -RUN apt-get update -RUN apt-get install -y --no-install-recommends ca-certificates=20230311 -RUN apt-get install -y --no-install-recommends curl=7.88.1-10+deb12u4 -RUN apt-get install -y --no-install-recommends gnupg=2.2.40-1.1 -RUN apt-get install -y --no-install-recommends unzip=6.0-28 -RUN apt-get install -y --no-install-recommends git=1:2.39.2-1.1 -RUN apt-get install -y --no-install-recommends jq=1.6-2.1 +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + ca-certificates=20230311 \ + curl=7.88.1-10+deb12u4 \ + gnupg=2.2.40-1.1 \ + unzip=6.0-28 \ + git=1:2.39.2-1.1 \ + jq=1.6-2.1 \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* WORKDIR /workspace RUN curl --show-error --fail --output "awscliv2.zip" --remote-name "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWS_CLI_VERSION}.zip" COPY security/awscliv2.asc ./ From de0e39ff6634e8b9d36528ee3c7d6da830812dcf Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Apr 2026 18:16:50 +0000 Subject: [PATCH 3/3] test: extend container structure tests with path and user verification Add commandTests to verify terraform and aws binaries are in PATH, confirm the container runs as nonroot (uid 1001), and that HOME is set. https://claude.ai/code/session_01RsmDFm6w4jVXwvzmRd9BCv --- tests/container-structure-tests.yml.template | 25 ++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/tests/container-structure-tests.yml.template b/tests/container-structure-tests.yml.template index 619fc87..efe73d4 100644 --- a/tests/container-structure-tests.yml.template +++ b/tests/container-structure-tests.yml.template @@ -33,6 +33,31 @@ commandTests: args: ["--version"] expectedOutput: ["aws-cli/${AWS_VERSION}"] + - name: "Check terraform is in PATH" + command: "which" + args: ["terraform"] + expectedOutput: ["/usr/local/bin/terraform"] + + - name: "Check aws is in PATH" + command: "which" + args: ["aws"] + expectedOutput: ["/usr/local/bin/aws"] + + - name: "Check running as non-root user" + command: "id" + args: ["-u"] + expectedOutput: ["1001"] + + - name: "Check running as nonroot user" + command: "id" + args: ["-un"] + expectedOutput: ["nonroot"] + + - name: "Check HOME directory is set" + command: "sh" + args: ["-c", "echo $HOME"] + expectedOutput: ["/home/nonroot"] + fileExistenceTests: - name: 'Check non-root user home' path: '/home/nonroot'