Fix security audit

ds-wizard · Jan 7, 2024 · bfe1604 · bfe1604
1 parent aefc57b
commit bfe1604
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -11,6 +11,12 @@ jobs:
     name: Grype
     runs-on: ubuntu-latest
 
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+
     strategy:
       fail-fast: false
       matrix:
@@ -19,7 +25,7 @@ jobs:
           - 3.11-docworker
 
     env:
-      IMAGE_BASE_NAME: 'python-base'
+      IMAGE_BASE_NAME: 'localhost:5000/test/python-base'
       DOCKER_META_CONTEXT: '.'
       DOCKER_META_FILE: './${{ matrix.tag }}/Dockerfile'
       DOCKER_META_PLATFORMS: 'linux/amd64,linux/arm64'
@@ -44,6 +50,8 @@ jobs:
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@v2
+        with:
+          driver-opts: network=host
 
       # TEST DOCKER IMAGE BUILD
       - name: Docker meta [test]
@@ -61,7 +69,7 @@ jobs:
           context: ${{ env.DOCKER_META_CONTEXT }}
           file: ${{ env.DOCKER_META_FILE }}
           platforms: ${{ env.DOCKER_META_PLATFORMS }}
-          push: false
+          push: true
           tags: ${{ steps.meta-test.outputs.tags }}
           labels: ${{ steps.meta-test.outputs.labels }}
           cache-from: type=gha

diff --git a/3.11-basic/Dockerfile b/3.11-basic/Dockerfile
@@ -17,8 +17,8 @@ ENV PIP_NO_COMPILE=1 \
 
 RUN chmod +x /bin/clean \
     && mkdir "$PIP_CACHE_DIR" && chmod a+rwx "$PIP_CACHE_DIR" \
-    && apk add sqlite-libs --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community \
     && apk add python3 python3-dev libffi-dev libpq-dev openssl-dev \
+    && apk add sqlite-libs=3.44.2-r0 --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community \
     && ln -s /usr/bin/pip3 /usr/bin/pip \
     && python3 -m ensurepip --upgrade \
     && pip install -U pip setuptools wheel \