Skip to content

Commit 7d4e807

Browse files
anthony-nhsanthony-nhs
committed
fix
1 parent 28228dc commit 7d4e807

File tree

6 files changed

+73
-4
lines changed

6 files changed

+73
-4
lines changed

‎Makefile‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,21 +85,29 @@ build-grant:
8585
docker build -f src/base/.devcontainer/Dockerfile.grant --tag local_grant:latest src/base/.devcontainer/; \
8686
fi
8787

88-
build-tflint: guard-GITHUB_TOKEN
88+
build-tflint:
8989
@if docker image inspect local_tflint:latest >/dev/null 2>&1; then \
9090
echo "Image local_tflint:latest already exists. Skipping build."; \
9191
else \
92+
if [ -z "$$GITHUB_TOKEN" ]; then \
93+
echo "GITHUB_TOKEN environment variable not set. Please set it by running 'make github-login' and setting GITHUB_TOKEN to the value of 'gh auth token'."; \
94+
exit 1; \
95+
fi; \
9296
docker buildx build \
9397
--secret id=GH_TOKEN,env=GITHUB_TOKEN \
9498
-f src/base/.devcontainer/Dockerfile.tflint \
9599
--tag local_tflint:latest \
96100
src/base/.devcontainer/; \
97101
fi
98102

99-
build-zizmor: guard-GITHUB_TOKEN
103+
build-zizmor:
100104
@if docker image inspect local_zizmor:latest >/dev/null 2>&1; then \
101105
echo "Image local_zizmor:latest already exists. Skipping build."; \
102106
else \
107+
if [ -z "$$GITHUB_TOKEN" ]; then \
108+
echo "GITHUB_TOKEN environment variable not set. Please set it by running 'make github-login' and setting GITHUB_TOKEN to the value of 'gh auth token'."; \
109+
exit 1; \
110+
fi; \
103111
docker buildx build \
104112
--secret id=GH_TOKEN,env=GITHUB_TOKEN \
105113
-f src/base/.devcontainer/Dockerfile.zizmor \

‎src/base/.devcontainer/.tool-versions‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
shellcheck 0.11.0
21
direnv 2.37.1
32
actionlint 1.7.12
43
ruby 3.3.0

‎src/base/.devcontainer/Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ ARG SAM_VERSION="v1.158.0"
1212
ARG ASDF_VERSION="v0.18.1"
1313
ARG GITLEAKS_VERSION="8.30.1"
1414
ARG CFN_GUARD_VERSION="3.2.0"
15+
ARG SHELLCHECK_VERSION="v0.11.0"
1516

1617
ENV SCRIPTS_DIR=${SCRIPTS_DIR}
1718
ENV CONTAINER_NAME=${CONTAINER_NAME}
@@ -20,12 +21,15 @@ ENV SAM_VERSION=${SAM_VERSION}
2021
ENV ASDF_VERSION=${ASDF_VERSION}
2122
ENV GITLEAKS_VERSION=${GITLEAKS_VERSION}
2223
ENV CFN_GUARD_VERSION=${CFN_GUARD_VERSION}
24+
ENV SHELLCHECK_VERSION=${SHELLCHECK_VERSION}
25+
2326
COPY --chmod=755 scripts/lifecycle/*.sh ${SCRIPTS_DIR}/
2427
COPY --chmod=755 scripts/root_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/root_install.sh
2528
COPY --chmod=755 scripts/install_aws_sam_cli.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/install_aws_sam_cli.sh
2629
COPY --chmod=755 scripts/install_asdf.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/install_asdf.sh
2730
COPY --chmod=755 scripts/install_gitleaks.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/install_gitleaks.sh
2831
COPY --chmod=755 scripts/install_cfn_guard.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/install_cfn_guard.sh
32+
COPY --chmod=755 scripts/install_shellcheck.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/install_shellcheck.sh
2933
COPY --chmod=755 Mk ${SCRIPTS_DIR}/Mk
3034

3135
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}

‎src/base/.devcontainer/scripts/install_shellcheck.sh‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
VERSION=${VERSION:-"v0.11.0"}
5+
# Expected SHA256 checksums taken from https://github.com/koalaman/shellcheck/releases/tag/v0.11.0
6+
# When we change shellcheck versions, these must be changed
7+
sha256sum_expected_arm="sha256:68a8133197a50beb8803f8d42f9908d1af1c5540d4bb05fdfca8c1fa47decefc"
8+
sha256sum_expected_amd64="sha256:b7af85e41cc99489dcc21d66c6d5f3685138f06d34651e6d34b42ec6d54fe6f6"
9+
10+
if [ "$(id -u)" -ne 0 ]; then
11+
echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
12+
exit 1
13+
fi
14+
15+
# Checks if packages are installed and installs them if not
16+
check_packages() {
17+
if ! dpkg -s "$@" > /dev/null 2>&1; then
18+
sudo apt-get -y install --no-install-recommends "$@"
19+
fi
20+
}
21+
22+
check_packages curl ca-certificates tar
23+
24+
install() {
25+
tmp_dir="$(mktemp -d)"
26+
trap 'rm -rf "${tmp_dir}"' EXIT
27+
28+
download_file="${tmp_dir}/shellcheck.tar.gz"
29+
30+
if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then
31+
download_url="https://github.com/koalaman/shellcheck/releases/download/${VERSION}/shellcheck-${VERSION}.linux.aarch64.tar.xz"
32+
sha256sum_expected="${sha256sum_expected_arm}"
33+
else
34+
download_url="https://github.com/koalaman/shellcheck/releases/download/${VERSION}/shellcheck-${VERSION}.linux.x86_64.tar.gz"
35+
sha256sum_expected="${sha256sum_expected_amd64}"
36+
fi
37+
echo "Downloading shellcheck from ${download_url}..."
38+
curl -fsSL "${download_url}" -o "${download_file}"
39+
40+
download_file_sha256sum=$(sha256sum "${download_file}" | awk '{print $1}')
41+
if [ "${download_file_sha256sum}" != "${sha256sum_expected#sha256:}" ]; then
42+
echo "SHA256 checksum mismatch for downloaded shellcheck archive"
43+
echo "Expected: ${sha256sum_expected}"
44+
echo "Actual: sha256:${download_file_sha256sum}"
45+
exit 1
46+
fi
47+
48+
tar -xzf "${download_file}" -C "${tmp_dir}"
49+
mkdir -p /usr/bin
50+
mv "${tmp_dir}/shellcheck-${VERSION}/shellcheck" /usr/bin/shellcheck
51+
chmod +x /usr/bin/shellcheck
52+
}
53+
echo "(*) Installing shellcheck..."
54+
55+
install
56+
57+
echo "Done!"

‎src/base/.devcontainer/scripts/root_install.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ VERSION="${SAM_VERSION}" "${SCRIPTS_DIR}/${CONTAINER_NAME}/install_aws_sam_cli.s
3838
VERSION="${ASDF_VERSION}" "${SCRIPTS_DIR}/${CONTAINER_NAME}/install_asdf.sh"
3939
# install gitleaks
4040
VERSION="${GITLEAKS_VERSION}" "${SCRIPTS_DIR}/${CONTAINER_NAME}/install_gitleaks.sh"
41+
# install shellcheck
42+
VERSION="${SHELLCHECK_VERSION}" "${SCRIPTS_DIR}/${CONTAINER_NAME}/install_shellcheck.sh"
4143

4244
# install gitsecrets
4345
# this should be removed once we have migrated all repos to gitleaks

‎src/base/.devcontainer/scripts/vscode_install.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ echo 'export GEM_HOME="$HOME/gems"' >> ~/.bashrc
1212
echo 'export PATH="$HOME/gems/bin:$PATH"' >> ~/.bashrc
1313

1414
# Install ASDF plugins
15-
asdf plugin add shellcheck https://github.com/luizm/asdf-shellcheck.git
1615
asdf plugin add direnv
1716
asdf plugin add actionlint
1817
asdf plugin add ruby https://github.com/asdf-vm/asdf-ruby.git

0 commit comments

Comments
 (0)