Release pipeline

.dockerignore

@@ -2,3 +2,5 @@
 README.md
 Dockerfile
 Makefile
+.github
+.gitignore

.github/workflows/docker-release.yml

@@ -0,0 +1,92 @@
+name: Build and Push Docker Image on Tag
+
+on:
+  push:
+    tags:
+      - "v*.*.*" # triggers on tags like v1.0.0
+
+jobs:
+
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        # https://github.com/actions/checkout/releases/tag/v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Set metadata
+        id: meta
+        run: |
+          echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+          echo "VCS_REF=${GITHUB_SHA}" >> $GITHUB_OUTPUT
+          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+          echo "LABEL_MAINTAINER=${{ github.repository_owner }}" >> $GITHUB_OUTPUT
+          echo "LABEL_IMAGE_SOURCE=${{ github.repository }}" >> $GITHUB_OUTPUT
+          echo "LABEL_IMAGE_URL=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+
+      - name: Set up Docker Buildx
+        # https://github.com/docker/setup-buildx-action/releases/tag/v4.0.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+
+      - name: Login to Docker Hub
+        # https://github.com/docker/login-action/releases/tag/v4.1.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        # https://github.com/docker/build-push-action/releases/tag/v7.1.0
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            VERSION=${{ steps.meta.outputs.VERSION }}
+            VCS_REF=${{ steps.meta.outputs.VCS_REF }}
+            BUILD_DATE=${{ steps.meta.outputs.BUILD_DATE }}
+            LABEL_MAINTAINER=${{ steps.meta.outputs.LABEL_MAINTAINER }}
+            LABEL_IMAGE_SOURCE=${{ steps.meta.outputs.LABEL_IMAGE_SOURCE }}
+            LABEL_IMAGE_URL=${{ steps.meta.outputs.LABEL_IMAGE_URL }}
+          tags: |
+            docker.io/${{ steps.meta.outputs.LABEL_IMAGE_URL }}:${{ steps.meta.outputs.VERSION }}
+            docker.io/${{ steps.meta.outputs.LABEL_IMAGE_URL }}:latest
+
+  security-scan-release:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Scan latest image after build
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    steps:
+      - name: Checkout code
+        # https://github.com/actions/checkout/releases/tag/v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Prepare image name
+        id: repo
+        run: echo "REPO=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+
+      - name: Run Trivy vulnerability scanner
+        # https://github.com/aquasecurity/trivy-action/releases/tag/v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
+        with:
+          image-ref: "docker.io/${{ steps.repo.outputs.REPO }}:latest"
+          format: "template"
+          template: "@/contrib/sarif.tpl"
+          output: "trivy-results.sarif"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        # https://github.com/github/codeql-action/releases/tag/v4.35.5
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba
+        with:
+          sarif_file: "trivy-results.sarif"

.github/workflows/trivy.yml

@@ -0,0 +1,51 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: trivy
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["master"]
+  schedule:
+    - cron: "38 2 * * 3"
+
+permissions:
+  contents: read
+
+jobs:
+  security-scan-master:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Security scan master
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        # https://github.com/actions/checkout/releases/tag/v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Prepare image name
+        id: repo
+        run: echo "REPO=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+
+      - name: Run Trivy vulnerability scanner
+        # https://github.com/aquasecurity/trivy-action/releases/tag/v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
+        with:
+          image-ref: "docker.io/${{ steps.repo.outputs.REPO }}:latest"
+          format: "template"
+          template: "@/contrib/sarif.tpl"
+          output: "trivy-results.sarif"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        # https://github.com/github/codeql-action/releases/tag/v4.35.5
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba
+        with:
+          sarif_file: "trivy-results.sarif"

Dockerfile

@@ -1,23 +1,38 @@
-FROM golang:latest
+FROM golang:alpine AS builder
 
-LABEL maintainer="Justin Azoff <justin.azoff@gmail.com>" \
+WORKDIR /app
+
+COPY . .
+
+RUN go install . 
+
+FROM alpine:latest
+
+ARG VERSION=dev
+ARG VCS_REF=dev
+ARG BUILD_DATE=unknown
+ARG LABEL_MAINTAINER="Justin Azoff <justin.azoff@gmail.com>"
+ARG LABEL_IMAGE_SOURCE="JustinAzoff/ssh-auth-logger"
+ARG LABEL_IMAGE_URL="justinazoff/ssh-auth-logger"
+
+LABEL maintainer="$LABEL_MAINTAINER" \
       org.opencontainers.image.title="ssh-auth-logger" \
       org.opencontainers.image.description="A low/zero interaction ssh authentication logging honeypot" \
-      org.opencontainers.image.source="https://github.com/JustinAzoff/ssh-auth-logger" \
-      org.opencontainers.image.url="https://hub.docker.com/r/justinazoff/ssh-auth-logger" \
-      org.opencontainers.image.documentation="https://github.com/JustinAzoff/ssh-auth-logger#" \
-      org.opencontainers.image.version="0.1.0"
-
+      org.opencontainers.image.source="https://github.com/$LABEL_IMAGE_SOURCE" \
+      org.opencontainers.image.url="https://hub.docker.com/r/$LABEL_IMAGE_URL" \
+      org.opencontainers.image.documentation="https://github.com/$LABEL_IMAGE_SOURCE#" \
+      org.opencontainers.image.version=$VERSION \
+      org.opencontainers.image.revision=$VCS_REF \
+      org.opencontainers.image.version=$VERSION
+
+ENV VERSION=$VERSION
 ENV USER=nobody
 ENV SSHD_BIND=:2222
 ENV TELNET_BIND=:2323
 
-WORKDIR /app
-
-COPY . .
+COPY --from=builder /go/bin/ssh-auth-logger /go/bin/ssh-auth-logger
 
-RUN go install . && \
-    touch /var/log/ssh-auth-logger.log && \
+RUN touch /var/log/ssh-auth-logger.log && \
     chown $USER /var/log/ssh-auth-logger.log && \
     chmod 644 /var/log/ssh-auth-logger.log
 

README.md

@@ -105,7 +105,7 @@ services:
           memory: 100M
     healthcheck:
       # Will test if port is still open AND log file was not vanished by host machine log rotate
-      test: wget -v localhost$$SSHD_BIND --no-verbose --tries=1 --spider && test -s /var/log/ssh-auth-logger.log || exit 1
+      test: pgrep ssh-auth-logger && test -s /var/log/ssh-auth-logger.log || exit 1
       interval: 5m00s
       timeout: 5s
       retries: 2