Refactor Docker build to use pre-built binaries and add security scanning#398
Refactor Docker build to use pre-built binaries and add security scanning#398
Conversation
…r build Replace cargo install with pre-built binary from GitHub Releases, eliminating the Rust toolchain builder stage. The workflow now triggers via workflow_run after binary build completes, ensuring the release asset is available before Docker image build. https://claude.ai/code/session_01GzHUQbhSrNrwQjmXR8JFi9
Scan Dockerfile config and base image for CRITICAL/HIGH vulnerabilities on PRs touching Dockerfile and weekly schedule. Results are uploaded to GitHub Security tab via SARIF. https://claude.ai/code/session_01GzHUQbhSrNrwQjmXR8JFi9
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
The downloader stage fetches the pre-built binary from GitHub Releases, and the final stage copies only the binary into a clean image. This keeps the Dockerfile self-contained while eliminating the Rust toolchain dependency. https://claude.ai/code/session_01GzHUQbhSrNrwQjmXR8JFi9
Performance Test Results 🚀Build Time: 2.872 seconds Executed with: scraps build -v |
Performance Test Results 🚀Build Time: 2.793 seconds Executed with: scraps build -v |
2 participants
Summary
This PR refactors the Docker build process and CI/CD pipeline to improve security and build efficiency:
Docker Build Refactoring: Simplifies the Dockerfile by removing the multi-stage Rust build and instead copying a pre-built binary from the build context. This reduces image size and build time.
CI/CD Pipeline Changes:
publish-docker-package.ymlto trigger on successful completion of the "Build binary and update homebrew" workflow instead of on release eventsSecurity Scanning: Adds a new
trivy-docker-scan.ymlworkflow that:debian:bookworm-slim) for OS package vulnerabilitiesRelated Issues
Additional Notes
The refactored approach decouples Docker image building from binary compilation, allowing the binary to be built once and reused across different deployment targets. The Trivy scanning provides continuous security monitoring of both the Dockerfile configuration and base image dependencies.
https://claude.ai/code/session_01GzHUQbhSrNrwQjmXR8JFi9