Skip to content

Commit c041636

Browse files
Merge pull request #68 from kevinbackhouse/static-dockerfile
Simplify docker setup
2 parents 9ea73ac + 003522b commit c041636

File tree

6 files changed

+59
-224
lines changed

6 files changed

+59
-224
lines changed

.github/workflows/release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
id: docker_build
3636
run: |
3737
echo ${{ secrets.GHCR_TOKEN }} | docker login ghcr.io -u GitHubSecurityLab --password-stdin
38-
python release_tools/publish_docker.py release.txt main.py ${{ env.REGISTRY }}/${{ env.USER }}/${{ env.IMAGE_NAME }} ${{ github.event.inputs.release_tag }}
38+
python release_tools/publish_docker.py ${{ env.REGISTRY }}/${{ env.USER }}/${{ env.IMAGE_NAME }} ${{ github.event.inputs.release_tag }}
3939
DIGEST=$(cat /tmp/digest.txt)
4040
echo "digest=$DIGEST" >> $GITHUB_OUTPUT
4141

docker/Dockerfile

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
FROM python:3.11-slim
2+
3+
WORKDIR /app
4+
5+
# Install system dependencies
6+
RUN apt-get update && apt-get install -y \
7+
curl \
8+
unzip \
9+
git \
10+
ca-certificates \
11+
&& rm -rf /var/lib/apt/lists/*
12+
13+
# Install Docker CLI (debian)
14+
RUN apt-get update \
15+
&& install -m 0755 -d /etc/apt/keyrings \
16+
&& curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
17+
&& chmod a+r /etc/apt/keyrings/docker.asc \
18+
&& echo \
19+
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
20+
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
21+
tee /etc/apt/sources.list.d/docker.list > /dev/null \
22+
&& apt-get update && apt-get install -y docker-ce-cli \
23+
&& rm -rf /var/lib/apt/lists/*
24+
25+
# Install GitHub CLI
26+
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
27+
&& chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
28+
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
29+
&& apt-get update \
30+
&& apt-get install -y gh \
31+
&& rm -rf /var/lib/apt/lists/*
32+
33+
# Install CodeQL CLI
34+
RUN curl -Ls -o /tmp/codeql.zip https://github.com/github/codeql-cli-binaries/releases/latest/download/codeql-linux64.zip \
35+
&& unzip /tmp/codeql.zip -d /opt \
36+
&& mv /opt/codeql /opt/codeql-cli \
37+
&& ln -s /opt/codeql-cli/codeql /usr/local/bin/codeql \
38+
&& rm /tmp/codeql.zip
39+
40+
# Install seclab-taskflow-agent from PyPI
41+
RUN pip install seclab-taskflow-agent
42+
43+
# Install CodeQL pack dependencies
44+
RUN export SECLAB_TASKFLOW_AGENT=$(python -c 'import seclab_taskflow_agent as x; print(x.__path__[0])') && \
45+
codeql pack install $SECLAB_TASKFLOW_AGENT/mcp_servers/codeql/queries/mcp-cpp && \
46+
codeql pack install $SECLAB_TASKFLOW_AGENT/mcp_servers/codeql/queries/mcp-js
47+
48+
ENTRYPOINT ["python", "-m", "seclab_taskflow_agent"]

release.txt

Lines changed: 0 additions & 122 deletions
This file was deleted.

release_tools/HOWTO.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,11 @@
22

33
To release an updated version of the Agent perform the following steps:
44

5-
1. Add any newly created files or dependencies to `release.txt`.
6-
7-
2. Release an updated Docker image:
5+
1. Release an updated Docker image:
86

97
```sh
108
docker login ghcr.io -u YOUR_GITHUB_USERNAME
11-
python release_tools/publish_docker.py release.txt main.py ghcr.io/githubsecuritylab/seclab-taskflow-agent latest
9+
python release_tools/publish_docker.py ghcr.io/githubsecuritylab/seclab-taskflow-agent latest
1210
```
1311

1412
Note: your login password is a GitHub PAT with packages write/read/delete scope enabled.

release_tools/publish_docker.py

Lines changed: 7 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -5,85 +5,6 @@
55
import shutil
66
import subprocess
77
import sys
8-
import tempfile
9-
10-
def read_file_list(list_path):
11-
"""
12-
Reads a file containing file paths, ignoring empty lines and lines starting with '#'.
13-
Returns a list of relative file paths.
14-
"""
15-
with open(list_path, "r") as f:
16-
lines = [line.strip() for line in f]
17-
return [line for line in lines if line and not line.startswith("#")]
18-
19-
def copy_files_to_dir(file_list, dest_dir):
20-
"""
21-
Copies files to dest_dir, preserving their relative paths.
22-
"""
23-
for rel_path in file_list:
24-
abs_src = os.path.abspath(rel_path)
25-
abs_dest = os.path.abspath(os.path.join(dest_dir, rel_path))
26-
os.makedirs(os.path.dirname(abs_dest), exist_ok=True)
27-
shutil.copy2(abs_src, abs_dest)
28-
29-
def write_dockerfile(dest_dir, entrypoint):
30-
"""
31-
Writes a Dockerfile that installs Python dependencies, GitHub CLI, and CodeQL CLI.
32-
"""
33-
dockerfile = f'''
34-
FROM python:3.11-slim
35-
36-
WORKDIR /app
37-
38-
# Install system dependencies
39-
RUN apt-get update && apt-get install -y \\
40-
curl \\
41-
unzip \\
42-
git \\
43-
ca-certificates \\
44-
&& rm -rf /var/lib/apt/lists/*
45-
46-
# Install Docker CLI (debian)
47-
RUN apt-get update \\
48-
&& install -m 0755 -d /etc/apt/keyrings \\
49-
&& curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \\
50-
&& chmod a+r /etc/apt/keyrings/docker.asc \\
51-
&& echo \\
52-
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \\
53-
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \\
54-
tee /etc/apt/sources.list.d/docker.list > /dev/null \\
55-
&& apt-get update && apt-get install -y docker-ce-cli \\
56-
&& rm -rf /var/lib/apt/lists/*
57-
58-
# Install GitHub CLI
59-
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \\
60-
&& chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \\
61-
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \\
62-
&& apt-get update \\
63-
&& apt-get install -y gh \\
64-
&& rm -rf /var/lib/apt/lists/*
65-
66-
# Install CodeQL CLI
67-
RUN curl -Ls -o /tmp/codeql.zip https://github.com/github/codeql-cli-binaries/releases/latest/download/codeql-linux64.zip \\
68-
&& unzip /tmp/codeql.zip -d /opt \\
69-
&& mv /opt/codeql /opt/codeql-cli \\
70-
&& ln -s /opt/codeql-cli/codeql /usr/local/bin/codeql \\
71-
&& rm /tmp/codeql.zip
72-
73-
COPY . /app
74-
75-
# Install CodeQL pack dependencies
76-
RUN codeql pack install /app/src/seclab_taskflow_agent/mcp_servers/codeql/queries/mcp-cpp
77-
RUN codeql pack install /app/src/seclab_taskflow_agent/mcp_servers/codeql/queries/mcp-js
78-
79-
# Install Python dependencies if pyproject.toml exists
80-
RUN pip install hatch
81-
RUN if [ -f pyproject.toml ]; then hatch run sync-deps; fi
82-
83-
ENTRYPOINT ["hatch", "run", "{entrypoint}"]
84-
'''
85-
with open(os.path.join(dest_dir, "Dockerfile"), "w") as f:
86-
f.write(dockerfile)
878

889
def get_image_digest(image_name, tag):
8910
result = subprocess.run(
@@ -111,23 +32,13 @@ def build_and_push_image(dest_dir, image_name, tag):
11132
f.write(digest)
11233

11334
if __name__ == "__main__":
114-
if len(sys.argv) != 5:
115-
print("Usage: python build_and_publish_docker.py <file_list.txt> <entrypoint.py> <ghcr_username/repo> <tag>")
116-
print("Example: python build_and_publish_docker.py files.txt main.py ghcr.io/anticomputer/my-python-app latest")
35+
if len(sys.argv) != 3:
36+
print("Usage: python build_and_publish_docker.py <ghcr_username/repo> <tag>")
37+
print("Example: python build_and_publish_docker.py ghcr.io/anticomputer/my-python-app latest")
11738
sys.exit(1)
11839

119-
file_list_path = sys.argv[1]
120-
entrypoint_py = sys.argv[2]
121-
image_name = sys.argv[3]
122-
tag = sys.argv[4]
123-
124-
# Read file paths
125-
file_list = read_file_list(file_list_path)
40+
image_name = sys.argv[1]
41+
tag = sys.argv[2]
12642

127-
with tempfile.TemporaryDirectory() as build_dir:
128-
# Copy files
129-
copy_files_to_dir(file_list, build_dir)
130-
# Write Dockerfile
131-
write_dockerfile(build_dir, entrypoint_py)
132-
# Build and push image
133-
build_and_push_image(build_dir, image_name, tag)
43+
# Build and push image
44+
build_and_push_image("docker", image_name, tag)

release_tools/release.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
#!/bin/sh
2-
python release_tools/publish_docker.py release.txt main ghcr.io/githubsecuritylab/seclab-taskflow-agent latest
2+
python release_tools/publish_docker.py ghcr.io/githubsecuritylab/seclab-taskflow-agent latest

0 commit comments

Comments
 (0)