Skip to content

Commit d6b1242

Browse files
sherifabdlnabysherifabdlnaby
authored
v6.0.0: Updates, patches, and maintenance! (#35)
1 parent bccc17f commit d6b1242

19 files changed

Lines changed: 748 additions & 182 deletions

‎.github/auto-release.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,4 +86,3 @@ template: |
8686
## Changes
8787
8888
$CHANGES
89-

‎.github/workflows/build-test-scan.yml‎

Lines changed: 209 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
# separate terms of service, privacy policy, and support
44
# documentation.
55

6-
# A sample workflow which checks out the code, builds a container
7-
# image using Docker and scans that image for vulnerabilities using
6+
# A sample workflow which checks out the code, builds multi-architecture container
7+
# images using Docker Buildx and scans that image for vulnerabilities using
88
# Snyk. The results are then uploaded to GitHub Security Code Scanning
99
#
1010
# For more examples, including how to limit scans to only high-severity
@@ -22,36 +22,222 @@ on:
2222
schedule:
2323
- cron: '41 5 * * 5'
2424

25+
# Prevent multiple concurrent runs for the same workflow
26+
concurrency:
27+
group: ${{ github.workflow }}-${{ github.ref }}
28+
cancel-in-progress: true
29+
2530
env:
2631
APP_BASE_DIR: "./app"
32+
REGISTRY: ghcr.io
33+
IMAGE_NAME: ${{ github.repository }}
2734

2835
jobs:
29-
Build-Test-Scan:
30-
runs-on: ubuntu-latest
36+
# Build multi-architecture images natively
37+
build:
38+
name: Build (${{ matrix.platform }} - ${{ matrix.target }})
39+
timeout-minutes: 30
40+
strategy:
41+
fail-fast: false
42+
matrix:
43+
include:
44+
- platform: linux/amd64
45+
runner: ubuntu-latest
46+
target: app
47+
- platform: linux/amd64
48+
runner: ubuntu-latest
49+
target: web
50+
- platform: linux/arm64
51+
runner: ubuntu-24.04-arm
52+
target: app
53+
- platform: linux/arm64
54+
runner: ubuntu-24.04-arm
55+
target: web
56+
runs-on: ${{ matrix.runner }}
3157
steps:
32-
- uses: actions/checkout@v2
58+
- name: Checkout
59+
uses: actions/checkout@v4
60+
3361
- name: Install Demo App
34-
uses: php-actions/composer@v6
62+
run: |
63+
# Pull composer image for the correct platform
64+
docker pull --platform ${{ matrix.platform }} composer:2
65+
# Run composer create-project
66+
docker run --rm --platform ${{ matrix.platform }} \
67+
-v ${{ github.workspace }}:/app \
68+
-w /app \
69+
composer:2 create-project \
70+
--no-install --no-scripts \
71+
symfony/symfony-demo app
72+
73+
- name: Set up Docker Buildx
74+
uses: docker/setup-buildx-action@v3
75+
76+
- name: Extract metadata for Docker
77+
id: meta
78+
uses: docker/metadata-action@v5
3579
with:
36-
dev: no
37-
command: create-project
38-
args: --no-install --no-scripts symfony/symfony-demo:v2.1.0 app
39-
php_version: 8.1
80+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.target }}
81+
tags: |
82+
type=ref,event=branch
83+
type=ref,event=pr
84+
type=sha
85+
type=raw,value=latest,enable={{is_default_branch}}
86+
87+
- name: Build image
88+
uses: docker/build-push-action@v6
89+
with:
90+
context: .
91+
platforms: ${{ matrix.platform }}
92+
target: ${{ matrix.target }}
93+
push: false
94+
load: true
95+
tags: kubephp-${{ matrix.target }}:test
96+
build-args: |
97+
APP_BASE_DIR=${{ env.APP_BASE_DIR }}
98+
BUILDPLATFORM=${{ matrix.platform }}
99+
TARGETPLATFORM=${{ matrix.platform }}
100+
cache-from: type=gha,scope=${{ matrix.platform }}-${{ matrix.target }}
101+
cache-to: type=gha,mode=max,scope=${{ matrix.platform }}-${{ matrix.target }}
102+
103+
- name: Test the App Startup
104+
if: matrix.target == 'app'
105+
run: |
106+
# Run container with explicit platform to ensure native execution
107+
docker run -d --name test-app --platform ${{ matrix.platform }} kubephp-app:test
108+
sleep 5
109+
docker exec test-app php -v
110+
docker exec test-app php -m
111+
docker stop test-app
112+
docker rm test-app
113+
114+
# Test the full stack on both AMD64 and ARM64 natively
115+
integration-test:
116+
name: Integration Test (${{ matrix.platform }})
117+
timeout-minutes: 20
118+
strategy:
119+
fail-fast: false
120+
matrix:
121+
include:
122+
- platform: linux/amd64
123+
runner: ubuntu-latest
124+
- platform: linux/arm64
125+
runner: ubuntu-24.04-arm
126+
runs-on: ${{ matrix.runner }}
127+
needs: build
128+
steps:
129+
- name: Checkout
130+
uses: actions/checkout@v4
131+
132+
- name: Install Demo App
133+
run: |
134+
# Pull composer image for the correct platform
135+
docker pull --platform ${{ matrix.platform }} composer:2
136+
# Run composer create-project
137+
docker run --rm --platform ${{ matrix.platform }} \
138+
-v ${{ github.workspace }}:/app \
139+
-w /app \
140+
composer:2 create-project \
141+
--no-install --no-scripts \
142+
symfony/symfony-demo app
143+
144+
- name: Set up Docker Buildx
145+
uses: docker/setup-buildx-action@v3
146+
40147
- name: Build & Deploy
41148
run: make deploy
149+
150+
- name: Wait for services to be ready
151+
run: |
152+
timeout=60
153+
elapsed=0
154+
while ! curl -f http://localhost:8080 >/dev/null 2>&1; do
155+
if [ $elapsed -ge $timeout ]; then
156+
echo "Service failed to start within $timeout seconds"
157+
docker compose -f docker-compose.prod.yml logs
158+
exit 1
159+
fi
160+
echo "Waiting for service... ($elapsed/$timeout seconds)"
161+
sleep 2
162+
elapsed=$((elapsed + 2))
163+
done
164+
echo "Service is ready!"
165+
42166
- name: Test the App Startup
43-
run: sleep 5 && curl localhost:8080 -I
44-
- name: Run Snyk to check Docker image for vulnerabilities
45-
# Snyk can be used to break the build when it detects vulnerabilities.
46-
# In this case we want to upload the issues to GitHub Code Scanning
47-
continue-on-error: true
48-
uses: snyk/actions/docker@14818c4695ecc4045f33c9cee9e795a788711ca4
49-
env:
50-
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
167+
run: |
168+
curl -f http://localhost:8080 -I
169+
curl -f http://localhost:8080 -s | head -50
170+
171+
# Security scanning on both architectures
172+
security-scan:
173+
name: Security Scan (${{ matrix.platform }})
174+
timeout-minutes: 30
175+
strategy:
176+
fail-fast: false
177+
matrix:
178+
include:
179+
- platform: linux/amd64
180+
runner: ubuntu-latest
181+
- platform: linux/arm64
182+
runner: ubuntu-24.04-arm
183+
runs-on: ${{ matrix.runner }}
184+
needs: build
185+
permissions:
186+
contents: read
187+
security-events: write
188+
actions: read
189+
steps:
190+
- name: Checkout
191+
uses: actions/checkout@v4
192+
193+
- name: Install Demo App
194+
run: |
195+
# Pull composer image for the correct platform
196+
docker pull --platform ${{ matrix.platform }} composer:2
197+
# Run composer create-project
198+
docker run --rm --platform ${{ matrix.platform }} \
199+
-v ${{ github.workspace }}:/app \
200+
-w /app \
201+
composer:2 create-project \
202+
--no-install --no-scripts \
203+
symfony/symfony-demo app
204+
205+
- name: Set up Docker Buildx
206+
uses: docker/setup-buildx-action@v3
207+
208+
- name: Build app image for scanning
209+
uses: docker/build-push-action@v6
51210
with:
52-
image: kubephp_app:latest kubephp_web:latest
53-
args: --file=Dockerfile --print-deps
54-
- name: Upload result to GitHub Code Scanning
55-
uses: github/codeql-action/upload-sarif@v1
211+
context: .
212+
platforms: ${{ matrix.platform }}
213+
target: app
214+
push: false
215+
load: true
216+
tags: kubephp-app:scan
217+
build-args: |
218+
APP_BASE_DIR=${{ env.APP_BASE_DIR }}
219+
BUILDPLATFORM=${{ matrix.platform }}
220+
TARGETPLATFORM=${{ matrix.platform }}
221+
cache-from: type=gha,scope=scan-${{ matrix.platform }}
222+
cache-to: type=gha,mode=max,scope=scan-${{ matrix.platform }}
223+
224+
- name: Run Trivy vulnerability scanner
225+
uses: aquasecurity/trivy-action@0.33.1
226+
with:
227+
image-ref: kubephp-app:scan
228+
format: sarif
229+
output: trivy-results.sarif
230+
severity: 'CRITICAL,HIGH'
231+
scanners: 'vuln,config,secret'
232+
exit-code: '0'
233+
# The template doesn't install PHP. The packages in this test are from the demo symfony app that is not part of this repo.
234+
trivy-args: >-
235+
--skip-dirs /app/vendor
236+
--skip-packages composer
237+
238+
- name: Upload Trivy results to GitHub Security
239+
uses: github/codeql-action/upload-sarif@v3
240+
if: always()
56241
with:
57-
sarif_file: snyk.sarif
242+
sarif_file: trivy-results.sarif
243+
wait-for-processing: true

‎.github/workflows/lint.yml‎

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,4 @@
1-
# This workflow uses actions that are not certified by GitHub.
2-
# They are provided by a third-party and are governed by
3-
# separate terms of service, privacy policy, and support
4-
# documentation.
5-
6-
# A sample workflow which checks out the code, builds a container
7-
# image using Docker and scans that image for vulnerabilities using
8-
# Snyk. The results are then uploaded to GitHub Security Code Scanning
9-
#
10-
# For more examples, including how to limit scans to only high-severity
11-
# issues, monitor images for newly disclosed vulnerabilities in Snyk and
12-
# fail PR checks for new vulnerabilities, see https://github.com/snyk/actions/
1+
# Lint workflow for Dockerfile and other configuration files
132

143
name: Lint
154

@@ -19,15 +8,30 @@ on:
198
pull_request:
209
branches: [ main ]
2110

22-
2311
jobs:
24-
Lint:
12+
hadolint:
13+
name: Dockerfile Lint
2514
runs-on: ubuntu-latest
2615
steps:
27-
- uses: actions/checkout@v2
16+
- uses: actions/checkout@v4
17+
2818
- name: Hadolint Action
29-
uses: hadolint/hadolint-action@v2.0.0
19+
uses: hadolint/hadolint-action@v3.1.0
3020
with:
3121
dockerfile: Dockerfile
3222
ignore: DL3018,SC2086,DL3019
3323
failure-threshold: warning
24+
25+
yaml-lint:
26+
name: YAML Lint
27+
runs-on: ubuntu-latest
28+
steps:
29+
- uses: actions/checkout@v4
30+
31+
- name: Lint YAML files
32+
uses: ibiqlik/action-yamllint@v3
33+
with:
34+
file_or_dir: .github/workflows/ docker-compose*.yml
35+
config_file: .yamllint.yml
36+
strict: false
37+
continue-on-error: true

‎.gitignore‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
# Application directory (dynamically created or user's app)
2+
/app/
3+
4+
# IDE
5+
/.idea/
6+
/.vscode/
17

28
###> symfony/framework-bundle ###
39
/.env.local
@@ -14,3 +20,10 @@
1420
.phpunit.result.cache
1521
/phpunit.xml
1622
###< symfony/phpunit-bridge ###
23+
24+
# Docker
25+
.docker/
26+
27+
# OS
28+
.DS_Store
29+
Thumbs.db

‎.yamllint.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
# YAML Lint configuration for GitHub Actions workflows and Docker Compose files
3+
extends: default
4+
5+
rules:
6+
# Line length - allow longer lines for readability
7+
line-length:
8+
max: 200
9+
level: warning
10+
11+
# Allow comments at end of lines
12+
comments:
13+
min-spaces-from-content: 1
14+
15+
# Allow empty values
16+
empty-values:
17+
forbid-in-block-mappings: false
18+
forbid-in-flow-mappings: false
19+
20+
# Indentation - 2 spaces for YAML
21+
indentation:
22+
spaces: 2
23+
indent-sequences: true
24+
check-multi-line-strings: false
25+
26+
# Allow document start
27+
document-start: disable
28+
29+
# Allow trailing spaces (sometimes needed in YAML)
30+
trailing-spaces: disable
31+
32+
# Allow new line at end of file
33+
new-line-at-end-of-file: disable
34+
35+
# Allow truthy values (yes, no, on, off, etc.)
36+
truthy:
37+
allowed-values: ['true', 'false', 'on', 'off', 'yes', 'no']
38+
check-keys: false
39+
40+
# Allow brackets in flow sequences
41+
brackets:
42+
max-spaces-inside: 1
43+
max-spaces-inside-empty: 0
44+
45+
# Allow colons in values (common in GitHub Actions)
46+
colons:
47+
max-spaces-before: 0
48+
max-spaces-after: 1
49+
50+
# Allow commas in flow mappings
51+
commas:
52+
max-spaces-before: 0
53+
min-spaces-after: 1
54+
max-spaces-after: 1
55+
56+
# Comments indentation
57+
comments-indentation: disable
58+
59+
# Key ordering - disable (not critical for workflows)
60+
key-ordering: disable

0 commit comments

Comments
 (0)