JanssenProject / jans

An open source enterprise digital identity platform for CIAM or workforce... Janssen is a distribution of standards-based, developer friendly, components that are engineered to work together in any cloud. #OAuth #OpenID #FIDO
https://docs.jans.io
Apache License 2.0
479 stars 75 forks source link

ci: fix docker build #10230

Closed moabu closed 1 week ago

moabu commented 1 week ago

Prepare


Description

Target issue

closes #10229

Implementation Details


Test and Document the changes

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

dryrunsecurity[bot] commented 1 week ago

DryRun Security Summary

The changes in this pull request focus on updating the versioning of Docker images used across various Janssen Project components by removing the "_dev" suffix from the IMAGE_VERSION variable, suggesting a move towards a more production-ready versioning scheme.

Expand for full summary
**Summary:** The changes in this pull request focus on updating the versioning of Docker images used across various Janssen Project components. The primary change is the removal of the "_dev" suffix from the `IMAGE_VERSION` variable, which suggests a move towards a more production-ready versioning scheme. From an application security perspective, these changes do not introduce any immediate security concerns. The Makefiles are primarily responsible for building and scanning the Docker images, which is a common practice for ensuring the security and integrity of containerized applications. However, it's important to review the broader context of the application, including the contents of the Dockerfiles, the security of the base images, and the overall build and deployment processes. Ensuring that appropriate security measures are in place, such as regular vulnerability scanning, secure dependency management, and hardening of the Docker images, is crucial for maintaining the application's security posture. Additionally, the use of shell commands to extract information from the Dockerfiles and the ability to pass custom arguments to the build and scanning targets should be carefully reviewed to mitigate potential security risks, such as command injection or improper input validation. Overall, the changes in this pull request appear to be focused on improving the build and versioning processes, and they do not raise any immediate security concerns. However, a comprehensive review of the application's security practices is recommended to ensure the ongoing security and reliability of the Janssen Project. **Files Changed:** 1. `docker-jans-all-in-one/Makefile`: The changes remove the "_dev" suffix from the `IMAGE_VERSION` variable, which is used to construct the Docker image version. 2. `docker-jans-auth-server/Makefile`: Similar changes to the `IMAGE_VERSION` variable, removing the "_dev" suffix. 3. `demos/benchmarking/docker-jans-loadtesting-jmeter/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 4. `.github/workflows/build-docker-image.yml`: This GitHub Actions workflow is updated to manage the versioning of Docker images, including the removal of the "_dev" suffix and support for manual image tagging. 5. `docker-jans-certmanager/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 6. `docker-jans-casa/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 7. `docker-jans-config-api/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 8. `docker-jans-configurator/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 9. `docker-jans-kc-scheduler/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 10. `docker-jans-keycloak-link/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 11. `docker-jans-fido2/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 12. `docker-jans-persistence-loader/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 13. `docker-jans-saml/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 14. `docker-jans-link/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 15. `docker-jans-monolith/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix. 16. `docker-jans-scim/Makefile`: The `IMAGE_VERSION` variable is updated to remove the "_dev" suffix.

Code Analysis

We ran 9 analyzers against 16 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer Findings
Sensitive Files Analyzer 14 findings

Riskiness

:green_circle: Risk threshold not exceeded.

View PR in the DryRun Dashboard.