From 55c2fc444d3aa75843ac2fc0002b24833547b439 Mon Sep 17 00:00:00 2001 From: benbenbang Date: Fri, 6 Nov 2026 14:38:01 -0500 Subject: [PATCH] ops(pre-commit): add terraform, mise and trivy to pre-commit image This change extends the pre-commit container with additional tooling and bumps existing tool versions. **New tools:** * Install Terraform (1.16.5), mise (v2026.11.3) and Trivy (0.75.0), each with architecture detection for amd64/arm64. * Add `jq` to the base package installation. **Version bumps:** * Upgrade Go base image to 1.27-alpine and Rust to 1.98.0. * Bump pipx to 1.16.0, GitHub CLI to 2.96.0, uv to 0.11.29 and prek to 0.4.10. **Build script hardening:** * Wire the new build args through `build_push.sh` and quote all build-arg values, the Dockerfile path and the context to guard against word splitting. --- ops/pre-commit/Dockerfile | 22 +++++++++++++++-- ops/pre-commit/build_push.sh | 46 ++++++++++++++++++++---------------- 2 files changed, 46 insertions(+), 22 deletions(-) diff --git a/ops/pre-commit/Dockerfile b/ops/pre-commit/Dockerfile index a330554..3390b4f 100644 --- a/ops/pre-commit/Dockerfile +++ b/ops/pre-commit/Dockerfile @@ -1,4 +1,4 @@ -ARG GO_IMAGE_VERSION=1.25-alpine +ARG GO_IMAGE_VERSION=1.27-alpine ARG PYTHON_IMAGE_VERSION=3.13-slim-bookworm FROM golang:${GO_IMAGE_VERSION} AS go FROM python:${PYTHON_IMAGE_VERSION} @@ -33,6 +33,15 @@ ENV PULUMI_VERSION=${PULUMI_VERSION} ARG RUST_VERSION=stable ENV RUST_VERSION=${RUST_VERSION} +ARG TERRAFORM_VERSION=1.16.5 +ENV TERRAFORM_VERSION=${TERRAFORM_VERSION} + +ARG MISE_VERSION=v2026.11.3 +ENV MISE_VERSION=${MISE_VERSION} + +ARG TRIVY_VERSION=0.75.0 +ENV TRIVY_VERSION=${TRIVY_VERSION} + WORKDIR /workspace ENV DEBIAN_FRONTEND=noninteractive @@ -51,7 +60,7 @@ SHELL [ "/bin/bash", "-c", "-o", "pipefail" ] RUN apt-get update && \ apt-get install -y --no-install-recommends git curl ca-certificates gnupg sudo \ - unzip wget openssl iproute2 coreutils wireguard-tools build-essential && \ + unzip wget openssl iproute2 coreutils wireguard-tools build-essential jq && \ # ---- install nodejs ---- # curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && \ apt-get install -y --no-install-recommends nodejs && \ @@ -75,6 +84,15 @@ RUN apt-get update && \ # ---- install hadolint ---- # if [ "$(uname -m)" = "x86_64" ]; then export PLATFORM="x86_64"; elif [ "$(uname -m)" = "aarch64" ] || [ "$(uname -m)" = "arm64" ]; then export PLATFORM="arm64"; else echo "Unsupported architecture"; exit 1; fi && \ curl -sSL https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/hadolint-Linux-${PLATFORM} --output /usr/local/bin/hadolint && \ + # ---- install terraform ---- # + if [ "$(uname -m)" = "x86_64" ]; then export TF_ARCH="amd64"; elif [ "$(uname -m)" = "aarch64" ] || [ "$(uname -m)" = "arm64" ]; then export TF_ARCH="arm64"; else echo "Unsupported architecture"; exit 1; fi && \ + curl -fsSL "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${TF_ARCH}.zip" -o /tmp/terraform.zip && \ + unzip -q /tmp/terraform.zip terraform -d /usr/local/bin && \ + # ---- install mise ---- # + curl -fsSL https://mise.run | MISE_INSTALL_PATH=/usr/local/bin/mise sh && \ + # ---- install trivy ---- # + if [ "$(uname -m)" = "x86_64" ]; then export TRIVY_ARCH="64bit"; elif [ "$(uname -m)" = "aarch64" ] || [ "$(uname -m)" = "arm64" ]; then export TRIVY_ARCH="ARM64"; else echo "Unsupported architecture"; exit 1; fi && \ + curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${TRIVY_ARCH}.tar.gz" | tar -xz -C /usr/local/bin trivy && \ # ---- install pulumi ---- # # curl -fsSL https://get.pulumi.com | sh -s -- --version ${PULUMI_VERSION} && \ # ---- install github cli ---- # diff --git a/ops/pre-commit/build_push.sh b/ops/pre-commit/build_push.sh index 45cf548..e728ee9 100644 --- a/ops/pre-commit/build_push.sh +++ b/ops/pre-commit/build_push.sh @@ -3,41 +3,47 @@ _CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" function build_images(){ - GO_IMAGE_VERSION=${GO_IMAGE_VERSION:-1.25-alpine} + GO_IMAGE_VERSION=${GO_IMAGE_VERSION:-1.27-alpine} PYTHON_IMAGE_VERSION=${PYTHON_IMAGE_VERSION:-3.13-slim-bookworm} - PIPX_VERSION=${PIPX_VERSION:-1.7.1} + PIPX_VERSION=${PIPX_VERSION:-1.16.0} HADOLINT_VERSION=${HADOLINT_VERSION:-v2.14.0} - GH_VERSION=${GH_VERSION:-2.95.0} - UV_VERSION=${UV_VERSION:-0.11.24} + GH_VERSION=${GH_VERSION:-2.96.0} + UV_VERSION=${UV_VERSION:-0.11.29} PRE_COMMIT_VERSION=${PRE_COMMIT_VERSION:-4.3.0} HELM_DOCS_VERSION=${HELM_DOCS_VERSION:-v1.14.2} NODE_VERSION=${NODE_VERSION:-26} - PREK_VERSION=${PREK_VERSION:-0.4.5} + PREK_VERSION=${PREK_VERSION:-0.4.10} PULUMI_VERSION=${PULUMI_VERSION:-3.3247.0} - RUST_VERSION=${RUST_VERSION:-1.96.0} + RUST_VERSION=${RUST_VERSION:-1.98.0} + TERRAFORM_VERSION=${TERRAFORM_VERSION:-1.16.5} + MISE_VERSION=${MISE_VERSION:-v2026.11.3} + TRIVY_VERSION=${TRIVY_VERSION:-0.75.0} docker buildx build --platform linux/amd64,linux/arm64 \ --no-cache \ - --build-arg GO_IMAGE_VERSION=${GO_IMAGE_VERSION} \ - --build-arg PYTHON_IMAGE_VERSION=${PYTHON_IMAGE_VERSION} \ - --build-arg PIPX_VERSION=${PIPX_VERSION} \ - --build-arg HADOLINT_VERSION=${HADOLINT_VERSION} \ - --build-arg GH_VERSION=${GH_VERSION} \ - --build-arg UV_VERSION=${UV_VERSION} \ - --build-arg PRE_COMMIT_VERSION=${PRE_COMMIT_VERSION} \ - --build-arg HELM_DOCS_VERSION=${HELM_DOCS_VERSION} \ - --build-arg RUST_VERSION=${RUST_VERSION} \ - --build-arg NODE_VERSION=${NODE_VERSION} \ - --build-arg PREK_VERSION=${PREK_VERSION} \ - --build-arg PULUMI_VERSION=${PULUMI_VERSION} \ + --build-arg GO_IMAGE_VERSION="${GO_IMAGE_VERSION}" \ + --build-arg PYTHON_IMAGE_VERSION="${PYTHON_IMAGE_VERSION}" \ + --build-arg PIPX_VERSION="${PIPX_VERSION}" \ + --build-arg HADOLINT_VERSION="${HADOLINT_VERSION}" \ + --build-arg GH_VERSION="${GH_VERSION}" \ + --build-arg UV_VERSION="${UV_VERSION}" \ + --build-arg PRE_COMMIT_VERSION="${PRE_COMMIT_VERSION}" \ + --build-arg HELM_DOCS_VERSION="${HELM_DOCS_VERSION}" \ + --build-arg RUST_VERSION="${RUST_VERSION}" \ + --build-arg TERRAFORM_VERSION="${TERRAFORM_VERSION}" \ + --build-arg MISE_VERSION="${MISE_VERSION}" \ + --build-arg TRIVY_VERSION="${TRIVY_VERSION}" \ + --build-arg NODE_VERSION="${NODE_VERSION}" \ + --build-arg PREK_VERSION="${PREK_VERSION}" \ + --build-arg PULUMI_VERSION="${PULUMI_VERSION}" \ -t ghcr.io/bitbrew-dev/pre-commit:latest \ -t ghcr.io/bitbrew-dev/r-workflows/pre-commit:latest \ -t ghcr.io/bitbrew-dev/reusable-workflows/pre-commit:latest \ -t ghcr.io/bitbrew-dev/r-workflows/prek:latest \ -t ghcr.io/bitbrew-dev/reusable-workflows/prek:latest \ --push \ - -f $_CURRENT_DIR/Dockerfile \ - $_CURRENT_DIR/. + -f "${_CURRENT_DIR}/Dockerfile" \ + "${_CURRENT_DIR}/." } build_images