diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml index 6bd5a18..2851b15 100644 --- a/.github/workflows/codacy.yml +++ b/.github/workflows/codacy.yml @@ -3,22 +3,21 @@ # separate terms of service, privacy policy, and support # documentation. -# This workflow checks out code, performs a Codacy security scan -# and integrates the results with the -# GitHub Advanced Security code scanning feature. For more information on -# the Codacy security scan action usage and parameters, see -# https://github.com/codacy/codacy-analysis-cli-action. +# This workflow checks out code, runs tests, generates a coverage report, +# performs a Codacy security scan, and integrates the results with GitHub +# Advanced Security for code scanning. For more information on the Codacy +# security scan action usage and parameters, see +# https://github.com/codacy/codacy-coverage-reporter-action. # For more information on Codacy Analysis CLI in general, see -# https://github.com/codacy/codacy-analysis-cli. +# https://github.com/codacy/codacy-coverage-reporter-action. -name: Codacy Security Scan +name: Codacy on: push: - branches: [ "main" ] + branches: [ main ] pull_request: - # The branches below must be a subset of the branches above - branches: [ "main" ] + branches: [ main ] schedule: - cron: '43 23 * * 5' @@ -28,34 +27,63 @@ permissions: jobs: codacy-security-scan: permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + contents: read + security-events: write + actions: read name: Codacy Security Scan runs-on: ubuntu-latest steps: - # Checkout the repository to the GitHub Actions runner - name: Checkout code uses: actions/checkout@v4 - # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis - - name: Run Codacy Analysis CLI - uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b + - name: Install Codacy Analysis CLI + run: | + sudo apt-get update && sudo apt-get install -y curl make + curl -L https://github.com/codacy/codacy-analysis-cli/releases/download/3.0.0/codacy-analysis-cli-3.0.0-linux-x86_64.tar.gz --output codacy-analysis-cli.tar.gz + tar xvzf codacy-analysis-cli.tar.gz + sudo mv codacy-analysis-cli-3.0.0/bin/codacy-analysis-cli /usr/local/bin/ + codacy-analysis-cli --version # Verify installation + + - name: Create coverage directory (ensure it exists) + run: mkdir -p ${{ github.workspace }}/tests/coverage + + - name: Run tests and generate coverage reports + run: | + docker run --rm -v ${{ github.workspace }}:/workspace codacy/codacy-analysis-cli:stable analyze --directory /workspace/src --format sarif --output /workspace/tests/coverage/results_dockerfile.sarif + + - name: Upload coverage reports to Codacy + env: + CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }} + run: | + codacy-coverage-reporter report -l -r ${{ github.workspace }}/tests/coverage/results_dockerfile.sarif + + upload-sarif: + name: Upload SARIF results + runs-on: ubuntu-latest + needs: codacy-security-scan + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Create coverage directory (ensure it exists) + run: mkdir -p ${{ github.workspace }}/tests/coverage + + - name: List files in coverage directory (debugging step) + run: ls -al ${{ github.workspace }}/tests/coverage + + - name: Wait for SARIF file to be created + run: | + echo "Waiting for SARIF file to be created..." + sleep 10 + + # Upload Dockerfile SARIF results to GitHub + - name: Upload Dockerfile SARIF results to GitHub + uses: github/codeql-action/upload-sarif@v3 with: - # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository - # You can also omit the token and run the tools that support default configurations - project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} - verbose: true - output: results.sarif - format: sarif - # Adjust severity of non-security issues - gh-code-scanning-compat: true - # Force 0 exit code to allow SARIF file generation - # This will handover control about PR rejection to the GitHub side - max-allowed-issues: 2147483647 - - # Upload the SARIF file generated in the previous step - - name: Upload SARIF results file - uses: github/codeql-action/upload-sarif@v2 + sarif_file: ${{ github.workspace }}/tests/coverage/results_dockerfile.sarif + + # Upload codebase SARIF results to GitHub + - name: Upload codebase SARIF results to GitHub + uses: github/codeql-action/upload-sarif@v3 with: - sarif_file: results.sarif + sarif_file: ${{ github.workspace }}/tests/coverage/results_codebase.sarif diff --git a/src/Dockerfile b/src/Dockerfile index b69ba0f..2018c4b 100644 --- a/src/Dockerfile +++ b/src/Dockerfile @@ -19,7 +19,7 @@ RUN apt-get update && \ pecl install apcu && \ docker-php-ext-enable apcu && \ docker-php-ext-configure gd --with-freetype --with-jpeg && \ - docker-php-ext-install -j$(nproc) gd mysqli pdo pdo_mysql zip intl ldap pgsql pdo_pgsql && \ + docker-php-ext-install -j$(nproc) gd mysqli pdo pdo_mysql zip intl ldap pgsql pdo_pgsql mbstring && \ a2enmod rewrite && \ a2enmod deflate && \ apt-get clean && rm -rf /var/lib/apt/lists/* diff --git a/tests/coverage/report.xml b/tests/coverage/report.xml new file mode 100644 index 0000000..c762c43 --- /dev/null +++ b/tests/coverage/report.xml @@ -0,0 +1,201 @@ + + + + + + + FROM php:8.3.8-apache AS builder + + + + RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + curl \ + unzip \ + libpng-dev \ + libjpeg-dev \ + libfreetype6-dev \ + libexif-dev \ + libzip-dev \ + zlib1g-dev \ + libicu-dev \ + libldap2-dev \ + libpq-dev \ + libonig-dev && \ + pecl install apcu && \ + docker-php-ext-enable apcu && \ + docker-php-ext-configure gd --with-freetype --with-jpeg && \ + docker-php-ext-install -j$(nproc) gd mysqli pdo pdo_mysql zip intl ldap pgsql pdo_pgsql && \ + a2enmod rewrite && \ + a2enmod deflate && \ + apt-get clean && rm -rf /var/lib/apt/lists/* + + + WORKDIR /tmp + ARG HUMHUB_VERSION=1.16.0 + RUN curl -L -o humhub.zip https://download.humhub.com/downloads/install/humhub-${HUMHUB_VERSION}.zip && \ + unzip humhub.zip -d /tmp/humhub_folder && \ + rm humhub.zip + + + + + FROM php:8.3.8-apache AS runtime-deps + + + + + + FROM runtime-deps AS final + + + + + LABEL org.opencontainers.image.source="https://github.com/GreenMeteor/humhub-docker" + LABEL org.opencontainers.image.revision="$GIT_COMMIT" + LABEL org.opencontainers.image.base.name="php:8.3.8-apache" + + + + + RUN groupadd -r humhub && useradd -r -g humhub humhub + + + + + COPY --from=builder /tmp/humhub_folder/. /var/www/html + + + + + COPY src/apache2.conf /etc/apache2/apache2.conf + COPY src/humhub.conf /etc/apache2/sites-available/humhub.conf + + + + + RUN a2ensite humhub + + + + + RUN chown -R humhub:humhub /var/www/html && \ + find /var/www/html -type d -exec chmod 755 {} + && \ + find /var/www/html -type f -exec chmod 644 {} + + + + + + COPY --chown=humhub:humhub src/crontab /etc/cron.d/humhub-cron + RUN chmod 0644 /etc/cron.d/humhub-cron + + + + + EXPOSE 80 + EXPOSE 443 + + + + + WORKDIR /var/www/html + + + + + HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \ + CMD curl --fail http://localhost || exit 1 + + + + + USER humhub + CMD ["sh", "-c", "service cron start && apache2-foreground"] + + + + + + + + + version: '3.8' + + + + services: + humhub: + build: + context: . + dockerfile: src/Dockerfile + environment: + MYSQL_HOST: "mysql_humhub" + MYSQL_DATABASE: "humhub" + MYSQL_USER: "humhub" + MYSQL_PASSWORD: "password" + HUMHUB_DIRECTORY: "/var/www/html" + MAILER_DSN: "sendmail://default" + volumes: + - humhub_files:/var/www/html + networks: + - humhub_network + read_only: true + security_opt: + - no-new-privileges:true + + + mysql_humhub: + image: mariadb:latest + environment: + MYSQL_DATABASE: "humhub" + MYSQL_USER: "humhub" + MYSQL_PASSWORD: "password" + volumes: + - humhub_db_data:/var/lib/mysql + read_only: true + security_opt: + - no-new-privileges:true + + + nginx: + image: nginx:latest + ports: + - "80:80" + - "443:443" + volumes: + - ./humhub.conf:/etc/nginx/conf.d/humhub.conf + - nginx_cert:/etc/letsencrypt + - /var/www/certbot:/var/www/certbot + networks: + - humhub_network + read_only: true + security_opt: + - no-new-privileges:true + + + certbot: + image: certbot/certbot + volumes: + - /var/www/certbot:/var/www/certbot + - nginx_cert:/etc/letsencrypt + entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'" + networks: + - humhub_network + read_only: true + security_opt: + - no-new-privileges:true + + + volumes: + humhub_files: + humhub_db_data: + nginx_cert: + + + networks: + humhub_network: + driver: bridge + + + +