Bytt til "nais/docker-build-push"-action

[slovrid]

Bytter fra docker/build-push-action GitHub action til å bruke NAIS sin nais/docker-build-push GitHub action. Dette gir oss en del fordeler blant annet mtp. stabilitet ved image-pulls da nais/docker-build-push går mot Google Artifact Registry (GAR) i stedet for GitHub Container Registry (GHCR), samt automatisk signering/scanning av Docker images via SALSA.

Det står en god del om dette i NAIS-docen, bla.a. Salsa - NAIS og OCI registry migration - NAIS. Noen relevante utdrag:

SLSA is short for Supply chain Levels for Software Artifacts pronounced salsa.

It is a security framework, essentially a checklist comprising standards and controls aimed at preventing tampering, enhancing integrity, and securing both packages and infrastructure within our projects.

If you utilize the nais/docker-build-push action for building and pushing your container image, you will automatically receive a signed attestation/SBOM (Software Bill of Materials) for your container image and its dependencies.

This SBOM will be uploaded to your container registry along with your image. The attestation is generated by the Trivy GitHub action and signed using cosign.

Upon deploying your image to NAIS, the attestation will undergo verification by the NAIS platform (picante) and will be uploaded to an SBOM analysis platform known as Dependency-Track. In Dependency-Track, you can examine the attestation as well as the vulnerabilities present in your image and its dependencies.

GHCR serves as a OCI registry hosted by GitHub, but it has certain limitations, such as imposing strict rate limits on the number of requests. We've encountered challenges with these rate limits, particularly when upgrading a cluster or restoring from a backup. In such instances, we've had to patiently wait for the rate limits to reset before deploying / restoring our applications.

On the other hand, GAR is a OCI registry hosted by Google, and we find it to be a more favorable solution for our needs. Additionally, as we transition to the cloud, the seamless integration with the Google Cloud Platform further enhances its appeal as a beneficial option for our operations.

Trello ticket number and link

• TC-380

[sonarqubecloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[slovrid]

Bytte fra Snyk til GitHub Advanced Security