Conversion of CI tooling from BrightCodeCompany repo by tonygermano · Pull Request #13 · OpenIntegrationEngine/engine-docker

tonygermano · 2026-10-15T14:13:00Z

Summary

This PR ports three pieces of CI tooling from
BrightCodeCompany/engine-docker (as of 450d8c0):

a workflow that updates the Docker Hub description from README.md
a workflow (and a local script) that scans a published image for vulnerabilities and opens an issue with
the report
a pull request check that the rendered dockerfiles/ match the templates and releases.yaml

It doesn't change the published images or the image build workflow.

The work is Kaur Palang's, from the BCC repo. The commits keep Kaur as the author. The BCC code is MPL-2.0, so
each ported commit message lists the BCC source commits and every change from the BCC version.

Commits

Add workflow to update Docker Hub description from README.md (Kaur Palang)
- New update-dockerhub-description.yaml. It runs when README.md changes on main, or by hand, and
  publishes README.md as the description of openintegrationengine/engine.
- Its concurrency group is dockerhub-description. BCC used the image build's group. GitHub keeps only one
  pending run per group, so a README push could cancel a queued image build.
Add vulnerability report generation (Kaur Palang)
- New generate-vulnerability-report.yaml, run by hand with an image tag (default latest). It scans the
  linux/amd64 image for that tag with Docker Scout, keeping only critical and high CVEs and ignoring CVEs
  from the base image. reports/render-report.ts turns the SARIF output into a Markdown report, and the
  workflow opens a GitHub issue with it.
- reports/local.sh [tag] runs the same scan and writes reports/report.md locally. It needs Docker
  Scout, jq and Node 26 or later. Both generated files are in .gitignore.
- The image tag and step outputs reach the shell through environment variables. BCC put ${{ }}
  expressions directly in the run scripts, which allows script injection through the tag input.
- Fixes to the report's Markdown tables (a stray |` in the Timestamp row, an extra empty cell in each
  findings row). The Filter row no longer says "fixed only", because the scan doesn't filter out CVEs that
  have no fix.
Add workflow to check that rendered Dockerfiles are up to date (Kaur Palang)
- New render-docker-templates.yaml. It runs on pull requests that touch releases.yaml,
  render_docker_templates.sh, templates/, dockerfiles/ or the workflow itself, or by hand.
- It fails if releases.yaml has duplicate version slugs, installs gomplate 4.3.2 (checked against a pinned
  SHA-512 and cached), runs ./render_docker_templates.sh, and fails if the result differs from the
  committed dockerfiles/.
- BCC's version could only be run by hand, installed gomplate in a separate job so it was never on PATH,
  only printed duplicate slugs, and threw away the rendered output. It now runs as a single job.

Setup

The Docker Hub description and vulnerability report workflows use the dockerhub environment from #12
(DOCKERHUB_USERNAME variable, DOCKERHUB_TOKEN secret). For the description update, the token needs
read, write and delete scope on openintegrationengine/engine. A read-only token isn't enough.

The vulnerability report workflow uses GITHUB_TOKEN with issues: write, so it needs no other secrets.

Testing

The render check should pass on this PR, since it touches its own workflow file. To see it fail, edit a
file in dockerfiles/ by hand or add a duplicate slug to releases.yaml.
After merging, run Generate Vulnerability Report by hand with tag latest and check that it opens an
issue with a readable report.
Update description in Docker Hub can be run by hand after merging to check the token.

🤖 Generated with Claude Code

When README.md changes on main, or when the workflow is run by hand, publish it as the Docker Hub repository description. Adapted from BrightCodeCompany/engine-docker@450d8c0 (MPL-2.0). Source commits: e6792bc b9b9f8a 163232b Modifications from the BCC version: - .github/workflows/update-dockerhub-description.yaml: repository is openintegrationengine/engine (BCC: brightcodecompany/openintegrationengine). The concurrency group is dockerhub-description (BCC: build-images). Sharing the image build's group let a README push cancel a queued image build, because GitHub keeps only one pending run per group. Signed-off-by: Kaur Palang <kaur.palang@brightcodecompany.com> Co-authored-by: Tony Germano <tony@germano.name> Signed-off-by: Tony Germano <tony@germano.name>

Add a manually run workflow that scans a published image tag (linux/amd64) with Docker Scout for critical and high CVEs, turns the SARIF output into a Markdown report, and opens a GitHub issue with it. reports/local.sh does the same scan locally. Adapted from BrightCodeCompany/engine-docker@450d8c0 (MPL-2.0). Source commits: 9c630f0 9e7cf91 e386fa2 351795d 599325f 1fc0440 Modifications from the BCC version: - .github/workflows/generate-vulnerability-report.yaml: image repository is openintegrationengine/engine (BCC: brightcodecompany/openintegrationengine). The image tag input and step outputs reach the shell through env variables (BCC: ${{ }} expressions inside run scripts, which allow script injection). $GITHUB_OUTPUT is quoted. - reports/local.sh: imageRepo is openintegrationengine/engine (BCC: brightcodecompany/openintegrationengine). imageTag defaults to latest (BCC: 4.6.0-rc1-alpine-jre), and can be set with the first argument. Added `set -euo pipefail`, and the script changes to its own directory so it can be run from anywhere. - reports/render-report.ts: the image reference in the report uses openintegrationengine/engine (BCC: brightcodecompany/openintegrationengine). Fixed the Markdown tables: removed a stray "|`" from the Timestamp row, an extra empty cell from each findings row, and a leading space before the High severity icon. The Filter row no longer says "fixed only", because the scan does not filter out CVEs without a fix. - .gitignore: ignore the generated reports/sarif.json and reports/report.md (not in BCC). Signed-off-by: Kaur Palang <kaur.palang@brightcodecompany.com> Co-authored-by: Tony Germano <tony@germano.name> Signed-off-by: Tony Germano <tony@germano.name>

On pull requests that touch the templates, releases.yaml, the render script or dockerfiles/, check releases.yaml for duplicate version slugs, install a checksum-verified copy of gomplate, re-render the templates, and fail if the result differs from the committed dockerfiles/. Adapted from BrightCodeCompany/engine-docker@450d8c0 (MPL-2.0). Source commits: 5a68694 fcd9f13 Modifications from the BCC version: - .github/workflows/render-docker-templates.yaml: - Merged the three jobs into one. In BCC, gomplate was installed in a separate job, so it was never on PATH in the render job. - The duplicate-slug check reads releases.yaml from the repository root (BCC: from the deleted deploy/ directory) and fails the job when duplicates are found (BCC: printed them only). - After rendering, the job fails if dockerfiles/ differs from the committed files (BCC: threw away the rendered output). - Added a pull_request trigger with path filters (BCC: workflow_dispatch only). - Removed the cache restore-keys fallback, so a cached binary is only used if it matches the pinned version and checksum. Removed the example "Show gomplate version" step and its numbered comments. Signed-off-by: Kaur Palang <kaur.palang@brightcodecompany.com> Co-authored-by: Tony Germano <tony@germano.name> Signed-off-by: Tony Germano <tony@germano.name>

kpalang · 2026-10-22T08:18:54Z

+    runs-on: ubuntu-latest
+    environment: dockerhub
+    steps:
+      - uses: actions/checkout@v6


issue (non-blocking): latest version is v7

kpalang · 2026-10-22T08:19:16Z

+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6


issue (non-blocking): latest version is v7

kpalang · 2026-10-22T08:21:08Z

+  render-dockerfiles:
+    runs-on: ubuntu-latest
+    env:
+      GOMPLATE_VERSION: 4.3.2


issue (non-blocking): Latest version is v5.3.0

kpalang · 2026-10-22T08:21:31Z

+      GOMPLATE_BIN: ${{ github.workspace }}/.cache/gomplate/gomplate
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6


issue (non-blocking): Latest version is v7

kpalang · 2026-10-22T08:22:18Z

+
+      - name: Cache gomplate binary
+        id: cache
+        uses: actions/cache@v5


issue (non-blocking): Latest version is v6

kpalang · 2026-10-22T08:23:27Z

+    runs-on: ubuntu-latest
+    environment: dockerhub
+    steps:
+      - uses: actions/checkout@v6


issue (non-blocking): Latest version is v7

kpalang

Some version bumps needed, otherwise looks good still.

Review comments formatted as conventional comments.

tonygermano added this pull request to stack #14 October 15, 2026 14:13

kpalang and others added 3 commits October 21, 2026 17:46

tonygermano force-pushed the tony/ci-tooling branch from 63e3165 to 0482014 Compare October 22, 2026 03:25

tonygermano mentioned this pull request Oct 22, 2026

Add 4.7.0 images and make them latest #15

Draft

kpalang approved these changes Oct 22, 2026

View reviewed changes

kpalang self-requested a review October 22, 2026 08:26

kpalang approved these changes Oct 22, 2026

View reviewed changes

Navigation Menu

Repository navigation

Conversion of CI tooling from BrightCodeCompany repo - #13

Conversion of CI tooling from BrightCodeCompany repo#13
tonygermano wants to merge 3 commits into
tony/templated-dockerfilesfrom
tony/ci-tooling

tonygermano commented Oct 15, 2026 •

edited

Loading

Uh oh!

kpalang Oct 22, 2026

Uh oh!

kpalang Oct 22, 2026

Uh oh!

kpalang Oct 22, 2026

Uh oh!

kpalang Oct 22, 2026

Uh oh!

kpalang Oct 22, 2026

Uh oh!

kpalang Oct 22, 2026

Uh oh!

kpalang left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

tonygermano commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Commits

Setup

Testing

Uh oh!

kpalang Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

kpalang Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

kpalang Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

kpalang Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

kpalang Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

kpalang Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

kpalang left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tonygermano commented Oct 15, 2026 •

edited

Loading