Run Inspec tests on devcontainer from pipeline (linux-baseline + custom)

[sebastian-sommerfeld-io]

RELATES TO

• 26

---

todo

• talk to AI about this
  • Turn this issue into user story

Run inspec tests against the dev container ...

:question:

• How can I make sure user "vscode" exists in the dev container and not in the container that is running inspec (which is the container/vm that runs the actions workflow)?
• Same for filesystem and filesystem permissions

components/test/compliance/inspec/devcontainer-profile/controls/decvontainer-checks.rb

##
#
##

title 'devcontainer checks'

control 'devcontainer-1.0' do
    impact 0.5
    title 'Verify devcontainer operating system'
    desc 'Verify the devcontainer operating system type and configuration'

    describe os.family do
        it { should eq 'debian' }
    end
end

control 'devcontainer-1.1' do
    impact 0.5
    title 'Verify user "vscode" presence and configuration'
    desc 'Verify that the user "vscode" is present and correctly configured'

    describe user('vscode') do
        it { should exist }
        its('home') { should eq '/home/vscode' }
        its('shell') { should eq '/bin/bash' }
    end
end

control 'devcontainer-1.2' do
    impact 0.5
    title 'Verify source2adoc directory'
    desc 'Verify that the source2adoc directory exists and has the correct ownership'
    describe directory('/workspaces/source2adoc') do
        it { should exist }
        it { should be_directory }
        its('owner') { should eq 'vscode' }
        its('group') { should eq 'vscode' }
    end
end

.github/workflows/pipeline.yml

  inspec-devcontainer:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Validate devcontainer profile
        run: |
          docker run --rm \
            --volume ./components/test/compliance/inspec:/inspec \
            --workdir /inspec \
            chef/inspec:latest check devcontainer-profile --chef-license=accept-no-persist
        shell: bash
      - name: Run devcontainer profile
        run: |
            docker run --rm \
            --volume ./components/test/compliance/inspec:/inspec \
            --volume /workspaces:/workspaces \
            --workdir /inspec \
            --user $(id -u):$(id -g) \
            chef/inspec:latest exec devcontainer-profile --chef-license=accept-no-persist
        shell: bash