feat: Full revamp of Dockerfile

.container-structure-test-config.yaml

@@ -0,0 +1,44 @@
+schemaVersion: '2.0.0'
+commandTests:
+  - name: "pre-commit"
+    command: "pre-commit"
+    args: ["-V"]
+    expectedOutput: ["^pre-commit ([0-9]+\\.){2}[0-9]+\\n$"]
+  - name: "terraform"
+    command: "terraform"
+    args: ["-version"]
+    expectedOutput: ["^Terraform v([0-9]+\\.){2}[0-9]+\\non linux_amd64\\n$"]
+  - name: "checkov"
+    command: "checkov"
+    args: ["--version"]
+    expectedOutput: ["^([0-9]+\\.){2}[0-9]+\\n$"]
+  - name: "infracost"
+    command: "infracost"
+    args: ["--version"]
+    expectedOutput: ["^Infracost v([0-9]+\\.){2}[0-9]+\\n$"]
+  - name: "terraform-docs"
+    command: "terraform-docs"
+    args: ["--version"]
+    expectedOutput: ["^terraform-docs version v([0-9]+\\.){2}[0-9]+ [a-z0-9]+ linux/amd64\\n$"]
+  - name: "terragrunt"
+    command: "terragrunt"
+    args: ["--version"]
+    expectedOutput: ["^terragrunt version v([0-9]+\\.){2}[0-9]+\\n$"]
+  - name: "terrascan"
+    command: "terrascan"
+    args: [ "version" ]
+    expectedOutput: [ "^version: v([0-9]+\\.){2}[0-9]+\\n$" ]
+  - name: "tflint"
+    command: "tflint"
+    args: [ "--version" ]
+    expectedOutput: [ "TFLint version ([0-9]+\\.){2}[0-9]+\\n$" ]
+  - name: "tfsec"
+    command: "tfsec"
+    args: [ "--version" ]
+    expectedOutput: [ "([0-9]+\\.){2}[0-9]+\\n$" ]
+fileExistenceTests:
+  - name: 'terrascan init'
+    path: '/root/.terrascan/pkg/policies/opa/rego/github/github_repository/privateRepoEnabled.rego'
+    shouldExist: true
+    uid: 0
+    gid: 0

.dive-ci.yaml

@@ -0,0 +1,13 @@
+rules:
+  # If the efficiency is measured below X%, mark as failed.
+  # Expressed as a ratio between 0-1.
+  lowestEfficiency: 0.99
+
+  # If the amount of wasted space is at least X or larger than X, mark as failed.
+  # Expressed in B, KB, MB, and GB.
+  highestWastedBytes: 1MB
+
+  # If the amount of wasted space makes up for X% or more of the image, mark as failed.
+  # Note: the base image layer is NOT included in the total image size.
+  # Expressed as a ratio between 0-1; fails if the threshold is met or crossed.
+  highestUserWastedPercent: 0.5

.dockerignore

@@ -1,3 +1,7 @@
-*
-!.dockerignore
-!Dockerfile
+Dockerfile
+.dockerignore
+.editorconfig
+.pre-commit-config.yaml
+.github
+.gitignore
+.hadolint.yaml

.github/workflows/build-image.yaml

@@ -12,8 +12,13 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
+      - uses: hadolint/[email protected]
+        with:
+          dockerfile: ./Dockerfile
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
+        with:
+          platforms: arm64
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
       - name: Login to GitHub Container Registry
@@ -31,7 +36,27 @@ jobs:
           context: .
           build-args: |
             INSTALL_ALL=true
-          platforms: linux/amd64
+          load: true
+          tags: |
+            ghcr.io/${{ github.repository }}:${{ env.IMAGE_TAG }}
+      - name: run structure tests
+        uses: plexsystems/[email protected]
+        with:
+          image: ghcr.io/${{ github.repository }}:${{ env.IMAGE_TAG }}
+          config: ${{ github.workspace }}/.container-structure-test-config.yaml
+      - name: Dive
+        uses: yuichielectric/[email protected]
+        with:
+          image: ghcr.io/${{ github.repository }}:${{ env.IMAGE_TAG }}
+          config-file: ${{ github.workspace }}/.dive-ci.yml
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and Push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          build-args: |
+            INSTALL_ALL=true
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: |
             ghcr.io/${{ github.repository }}:${{ env.IMAGE_TAG }}

.github/workflows/pre-commit.yaml

@@ -25,6 +25,13 @@ jobs:
     - name: Install shellcheck
       run: |
         sudo apt update && sudo apt install shellcheck
+
+
+    - name: Install hadolint
+      run: |
+        curl -L "$(curl -s https://api.github.com/repos/hadolint/hadolint/releases/latest | grep -o -E -m 1 "https://.+?/hadolint-Linux-x86_64")" > hadolint \
+        && chmod +x hadolint && sudo mv hadolint /usr/bin/
+
     # Need to success pre-commit fix push
     - uses: actions/checkout@v2
       with: