Skip to content

Commit 0b4cdd5

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-0000] - move to common dev container (#543)
## Summary - Routine Change ### Details - move to common dev container
1 parent cf4f69e commit 0b4cdd5

19 files changed

Lines changed: 299 additions & 885 deletions

‎.devcontainer/Dockerfile‎

Lines changed: 12 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,70 +1,14 @@
1-
FROM mcr.microsoft.com/devcontainers/base:ubuntu
2-
3-
ARG TARGETARCH
4-
ENV TARGETARCH=${TARGETARCH}
5-
6-
ARG ASDF_VERSION
7-
COPY .tool-versions.asdf /tmp/.tool-versions.asdf
8-
9-
RUN apt-get update \
10-
&& export DEBIAN_FRONTEND=noninteractive \
11-
&& apt-get -y dist-upgrade \
12-
&& apt-get -y install --no-install-recommends htop vim curl git build-essential \
13-
libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev libbz2-dev \
14-
zlib1g-dev unixodbc unixodbc-dev libsecret-1-0 libsecret-1-dev libsqlite3-dev \
15-
jq apt-transport-https ca-certificates gnupg-agent \
16-
software-properties-common bash-completion python3-pip make libbz2-dev \
17-
libreadline-dev libsqlite3-dev wget llvm libncurses5-dev libncursesw5-dev \
18-
xz-utils tk-dev liblzma-dev libyaml-dev
19-
20-
21-
# Download correct AWS CLI for arch
22-
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
23-
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip"; \
24-
else \
25-
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"; \
26-
fi && \
27-
unzip /tmp/awscliv2.zip -d /tmp/aws-cli && \
28-
/tmp/aws-cli/aws/install && \
29-
rm /tmp/awscliv2.zip && rm -rf /tmp/aws-cli
30-
31-
# Download correct SAM CLI for arch
32-
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
33-
wget -O /tmp/aws-sam-cli.zip "https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-arm64.zip"; \
34-
else \
35-
wget -O /tmp/aws-sam-cli.zip "https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-x86_64.zip"; \
36-
fi && \
37-
unzip /tmp/aws-sam-cli.zip -d /tmp/aws-sam-cli && \
38-
/tmp/aws-sam-cli/install && \
39-
rm /tmp/aws-sam-cli.zip && rm -rf /tmp/aws-sam-cli
40-
41-
# Install ASDF
42-
RUN ASDF_VERSION=$(awk '!/^#/ && NF {print $1; exit}' /tmp/.tool-versions.asdf) && \
43-
if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" = "aarch64" ]; then \
44-
wget -O /tmp/asdf.tar.gz https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-arm64.tar.gz; \
1+
ARG IMAGE_NAME=node_24_python_3_14
2+
ARG IMAGE_VERSION=latest
3+
FROM ghcr.io/nhsdigital/eps-devcontainers/${IMAGE_NAME}:${IMAGE_VERSION}
4+
5+
USER root
6+
# specify DOCKER_GID to force container docker group id to match host
7+
RUN if [ -n "${DOCKER_GID}" ]; then \
8+
if ! getent group docker; then \
9+
groupadd -g ${DOCKER_GID} docker; \
4510
else \
46-
wget -O /tmp/asdf.tar.gz https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-amd64.tar.gz; \
11+
groupmod -g ${DOCKER_GID} docker; \
4712
fi && \
48-
tar -xvzf /tmp/asdf.tar.gz && \
49-
mv asdf /usr/bin
50-
51-
52-
USER vscode
53-
54-
ENV PATH="$PATH:/home/vscode/.asdf/shims/:/workspaces/eps-cdk-utils/node_modules/.bin"
55-
56-
# Install ASDF plugins
57-
RUN asdf plugin add python; \
58-
asdf plugin add poetry https://github.com/asdf-community/asdf-poetry.git; \
59-
asdf plugin add shellcheck https://github.com/luizm/asdf-shellcheck.git; \
60-
asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git; \
61-
asdf plugin add direnv; \
62-
asdf plugin add actionlint;
63-
64-
WORKDIR /workspaces/eps-workflow-quality-checks
65-
66-
ADD .tool-versions /workspaces/eps-cdk-utils/.tool-versions
67-
ADD .tool-versions /home/vscode/.tool-versions
68-
69-
RUN asdf install python; \
70-
asdf install
13+
usermod -aG docker vscode; \
14+
fi

‎.devcontainer/devcontainer.json‎

Lines changed: 43 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,47 @@
1-
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
2-
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
31
{
4-
"name": "Ubuntu",
5-
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
6-
"build": {
7-
"dockerfile": "Dockerfile",
8-
"context": "..",
9-
"args": {}
10-
},
11-
"mounts": [
12-
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
13-
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",
14-
"source=${env:HOME}${env:USERPROFILE}/.gnupg,target=/home/vscode/.gnupg,type=bind",
15-
"source=${env:HOME}${env:USERPROFILE}/.npmrc,target=/home/vscode/.npmrc,type=bind"
16-
],
17-
"features": {
18-
"ghcr.io/devcontainers/features/github-cli:1": {},
19-
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
20-
"version": "latest",
21-
"moby": "true",
22-
"installDockerBuildx": "true"
23-
}
24-
},
25-
"remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" },
26-
"containerUser": "vscode",
27-
"customizations": {
28-
"vscode": {
29-
"extensions": [
30-
"AmazonWebServices.aws-toolkit-vscode",
31-
"redhat.vscode-yaml",
32-
"eamodio.gitlens",
33-
"github.vscode-pull-request-github",
34-
"streetsidesoftware.code-spell-checker",
35-
"timonwong.shellcheck",
36-
"github.vscode-github-actions"
37-
],
38-
"settings": {
39-
"cSpell.words": ["fhir", "Formik", "pino", "serialisation"]
40-
}
2+
"name": "Ubuntu",
3+
"build": {
4+
"dockerfile": "Dockerfile",
5+
"context": "..",
6+
"args": {
7+
"DOCKER_GID": "${env:DOCKER_GID:}",
8+
"IMAGE_NAME": "node_24_python_3_14",
9+
"IMAGE_VERSION": "v1.0.7",
10+
"USER_UID": "${localEnv:USER_ID:}",
11+
"USER_GID": "${localEnv:GROUP_ID:}"
12+
}
13+
},
14+
"postAttachCommand": "git-secrets --register-aws; git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt",
15+
"mounts": [
16+
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
17+
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",
18+
"source=${env:HOME}${env:USERPROFILE}/.gnupg,target=/home/vscode/.gnupg,type=bind",
19+
"source=${env:HOME}${env:USERPROFILE}/.npmrc,target=/home/vscode/.npmrc,type=bind"
20+
],
21+
"features": {},
22+
"remoteEnv": {
23+
"LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}"
24+
},
25+
"containerUser": "vscode",
26+
"customizations": {
27+
"vscode": {
28+
"extensions": [
29+
"AmazonWebServices.aws-toolkit-vscode",
30+
"redhat.vscode-yaml",
31+
"eamodio.gitlens",
32+
"github.vscode-pull-request-github",
33+
"streetsidesoftware.code-spell-checker",
34+
"timonwong.shellcheck",
35+
"github.vscode-github-actions"
36+
],
37+
"settings": {
38+
"cSpell.words": [
39+
"fhir",
40+
"Formik",
41+
"pino",
42+
"serialisation"
43+
]
4144
}
4245
}
4346
}
47+
}

‎.github/workflows/ci.yml‎

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -26,55 +26,64 @@ jobs:
2626
# echo "commit_id=${{ github.sha }}" >> "$GITHUB_ENV"
2727
echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
2828
echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
29-
get_asdf_version:
29+
get_config_values:
3030
runs-on: ubuntu-22.04
3131
outputs:
32-
asdf_version: ${{ steps.asdf-version.outputs.version }}
3332
tag_format: ${{ steps.load-config.outputs.TAG_FORMAT }}
33+
devcontainer_version: ${{ steps.load-config.outputs.DEVCONTAINER_VERSION }}
34+
devcontainer_image: ${{ steps.load-config.outputs.DEVCONTAINER_IMAGE }}
3435
steps:
3536
- name: Checkout code
3637
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
3738

38-
- name: Get asdf version
39-
id: asdf-version
40-
run: echo "version=$(awk '!/^#/ && NF {print $1; exit}' .tool-versions.asdf)" >> "$GITHUB_OUTPUT"
4139
- name: Load config value
4240
id: load-config
4341
run: |
4442
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
45-
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
43+
DEVCONTAINER_IMAGE=$(jq -r '.build.args.IMAGE_NAME' .devcontainer/devcontainer.json)
44+
DEVCONTAINER_VERSION=$(jq -r '.build.args.IMAGE_VERSION' .devcontainer/devcontainer.json)
45+
{
46+
echo "TAG_FORMAT=$TAG_FORMAT"
47+
echo "DEVCONTAINER_IMAGE=$DEVCONTAINER_IMAGE"
48+
echo "DEVCONTAINER_VERSION=$DEVCONTAINER_VERSION"
49+
} >> "$GITHUB_OUTPUT"
4650
quality_checks:
47-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@d215f841eb18b803e339e4ed597ed1f30e086e17
48-
needs: [get_asdf_version, get_commit_id]
51+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@36677e1d6bfaa010d7b78942a1ade12fbefecb80
52+
needs: [get_config_values, get_commit_id]
4953
with:
50-
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
54+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
5155
run_docker_scan: true
5256
docker_images: "eps-cdk-utils"
5357
secrets:
5458
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
5559

5660
tag_release:
57-
needs: [quality_checks, get_commit_id, get_asdf_version]
58-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release.yml@d215f841eb18b803e339e4ed597ed1f30e086e17
61+
needs: [quality_checks, get_commit_id, get_config_values]
62+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@36677e1d6bfaa010d7b78942a1ade12fbefecb80
5963
with:
6064
dry_run: true
61-
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
65+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
6266
branch_name: main
6367
publish_packages: packages/cdkConstructs,packages/deploymentUtils
64-
tag_format: ${{ needs.get_asdf_version.outputs.tag_format }}
68+
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
69+
verify_published_from_main_image: true
6570
secrets: inherit
6671

6772
package_code:
68-
needs: [tag_release, quality_checks, get_commit_id]
73+
needs: [tag_release, quality_checks, get_commit_id, get_config_values]
6974
uses: ./.github/workflows/docker_image_build.yml
7075
with:
76+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
77+
verify_published_from_main_image: true
7178
VERSION_NUMBER: pre-release-${{ needs.get_commit_id.outputs.sha_short }}
7279
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
7380

7481
release_dev:
75-
needs: [tag_release, package_code, get_commit_id]
82+
needs: [tag_release, package_code, get_commit_id, get_config_values]
7683
uses: ./.github/workflows/docker_image_upload.yml
7784
with:
85+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
86+
verify_published_from_main_image: true
7887
AWS_ENVIRONMENT: dev
7988
VERSION_NUMBER: pre-release-${{ needs.get_commit_id.outputs.sha_short }}
8089
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
@@ -84,9 +93,12 @@ jobs:
8493
CDK_PUSH_IMAGE_ROLE: ${{ secrets.DEV_CDK_PUSH_IMAGE_ROLE }}
8594

8695
release_qa:
87-
needs: [tag_release, release_dev, package_code, get_commit_id]
96+
needs:
97+
[tag_release, release_dev, package_code, get_commit_id, get_config_values]
8898
uses: ./.github/workflows/docker_image_upload.yml
8999
with:
100+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
101+
verify_published_from_main_image: true
90102
AWS_ENVIRONMENT: qa
91103
VERSION_NUMBER: pre-release-${{ needs.get_commit_id.outputs.sha_short }}
92104
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
@@ -96,9 +108,12 @@ jobs:
96108
CDK_PUSH_IMAGE_ROLE: ${{ secrets.QA_CDK_PUSH_IMAGE_ROLE }}
97109

98110
release_ref:
99-
needs: [tag_release, release_dev, package_code, get_commit_id]
111+
needs:
112+
[tag_release, release_dev, package_code, get_commit_id, get_config_values]
100113
uses: ./.github/workflows/docker_image_upload.yml
101114
with:
115+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
116+
verify_published_from_main_image: true
102117
AWS_ENVIRONMENT: ref
103118
VERSION_NUMBER: pre-release-${{ needs.get_commit_id.outputs.sha_short }}
104119
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
@@ -108,5 +123,8 @@ jobs:
108123
CDK_PUSH_IMAGE_ROLE: ${{ secrets.REF_CDK_PUSH_IMAGE_ROLE }}
109124

110125
package_npm_code:
111-
needs: [quality_checks, get_commit_id]
126+
needs: [quality_checks, get_commit_id, get_config_values]
112127
uses: ./.github/workflows/package_npm_code.yml
128+
with:
129+
runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"
130+
verify_published_from_main_image: true

‎.github/workflows/docker_image_build.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,36 @@ on:
99
COMMIT_ID:
1010
required: true
1111
type: string
12+
runtime_docker_image:
13+
type: string
14+
required: true
15+
verify_published_from_main_image:
16+
type: boolean
17+
required: true
1218

1319
jobs:
20+
verify_attestation:
21+
uses: NHSDigital/eps-common-workflows/.github/workflows/verify-attestation.yml@36677e1d6bfaa010d7b78942a1ade12fbefecb80
22+
with:
23+
runtime_docker_image: "${{ inputs.runtime_docker_image }}"
24+
verify_published_from_main_image: ${{ inputs.verify_published_from_main_image }}
1425
docker_image_build:
1526
runs-on: ubuntu-22.04
27+
needs: verify_attestation
28+
container:
29+
image: ${{ needs.verify_attestation.outputs.pinned_image }}
30+
options: --user 1001:1001 --group-add 128
31+
defaults:
32+
run:
33+
shell: bash
1634
permissions:
1735
id-token: write
1836
contents: read
1937
packages: read
2038
steps:
39+
- name: copy .tool-versions
40+
run: |
41+
cp /home/vscode/.tool-versions "$HOME/.tool-versions"
2142
- name: Checkout code
2243
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2344
with:

‎.github/workflows/docker_image_upload.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,40 @@ on:
1818
DOCKER_IMAGE_TAG:
1919
required: true
2020
type: string
21+
runtime_docker_image:
22+
type: string
23+
required: true
24+
verify_published_from_main_image:
25+
type: boolean
26+
required: true
2127
secrets:
2228
CDK_PUSH_IMAGE_ROLE:
2329
required: true
2430

2531
jobs:
32+
verify_attestation:
33+
uses: NHSDigital/eps-common-workflows/.github/workflows/verify-attestation.yml@36677e1d6bfaa010d7b78942a1ade12fbefecb80
34+
with:
35+
runtime_docker_image: "${{ inputs.runtime_docker_image }}"
36+
verify_published_from_main_image: ${{ inputs.verify_published_from_main_image }}
2637
upload_docker_image:
38+
needs: verify_attestation
2739
runs-on: ubuntu-22.04
40+
container:
41+
image: ${{ needs.verify_attestation.outputs.pinned_image }}
42+
options: --user 1001:1001 --group-add 128
43+
defaults:
44+
run:
45+
shell: bash
2846
environment: ${{ inputs.AWS_ENVIRONMENT }}
2947
permissions:
3048
id-token: write
3149
contents: write
3250

3351
steps:
52+
- name: copy .tool-versions
53+
run: |
54+
cp /home/vscode/.tool-versions "$HOME/.tool-versions"
3455
- name: Checkout local github actions
3556
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
3657
with:

0 commit comments

Comments
 (0)