Skip to content

Ops 5780 cap 1 ci to build and publish arm based docker images #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zeevkamin-mend wants to merge 15 commits into
base: main
Choose a base branch
from
Open

Ops 5780 cap 1 ci to build and publish arm based docker images #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
5b3b8eb
WF chnages and scripts
zeevkamin-mend Feb 19, 2026
180b46f
sleep
zeevkamin-mend Feb 19, 2026
739ec19
syntax
zeevkamin-mend Feb 19, 2026
99268b0
sleep
zeevkamin-mend Feb 19, 2026
f687190
non slack
zeevkamin-mend Feb 19, 2026
33834a2
modifications
zeevkamin-mend Feb 19, 2026
006f490
apply remediate
zeevkamin-mend Feb 19, 2026
c51c6aa
chnages to be applied
zeevkamin-mend Feb 22, 2026
e52024d
sleep
zeevkamin-mend Feb 22, 2026
4ddb8ef
running with correct code
zeevkamin-mend Feb 22, 2026
12393d2
removed sleep
zeevkamin-mend Feb 22, 2026
e69797f
sleep
zeevkamin-mend Feb 22, 2026
23d8f3f
Fix: Separate scanner and scanner-full modifications
zeevkamin-mend Feb 22, 2026
d1327e1
no sleep
zeevkamin-mend Feb 22, 2026
06b66db
chnaged delimiter
zeevkamin-mend Feb 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 35 additions & 19 deletions .github/workflows/stg-from-version-build-push-tag-base-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,19 +24,34 @@ on:
description: "TriggeredBy: (default manual) Indicates what triggered this workflow. Set to 'ubuntu-refresh' to suppress Slack notifications."
default: "manual"
type: string

permissions:
contents: write
id-token: write

jobs:
Staging_Build_And_Push_Base_Image_From_Version:
runs-on: [mend-self-hosted, profile=developer-platform-xlarge-od]
runs-on: [mend-self-hosted, "profile=${{ matrix.runner_profile }}"]
strategy:
fail-fast: false
matrix:
include:
- arch: amd64
runner_profile: developer-platform-xlarge-od
tag_suffix: ""
platform_info: ""
handle_git: false
- arch: arm64
runner_profile: renovate-arm-od
tag_suffix: "-arm64"
platform_info: "ARM64"
handle_git: false
Comment on lines +39 to +48

@coderabbitai coderabbitai Bot Feb 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

handle_git: false for both matrix entries fully disables the Branch, Commit, Push and Tag Changes step.

Both amd64 and arm64 set handle_git: false, so the if: matrix.handle_git == true guard on Line 113 is never satisfied. Release branch creation, tagging, and merge-to-develop will never execute. Before this PR those operations ran unconditionally; this is a functional regression.

If the intent is that only one architecture performs git operations (as is typical — git work should not be duplicated per-arch), the amd64 entry should have handle_git: true:

         - arch: amd64
           runner_profile: developer-platform-xlarge-od
           tag_suffix: ""
           platform_info: ""
-          handle_git: false
+          handle_git: true
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/stg-from-version-build-push-tag-base-image.yaml around
lines 39 - 48, The matrix currently sets handle_git: false for both entries so
the workflow condition if: matrix.handle_git == true never runs; update the
matrix so only one architecture (typically the amd64 entry with arch: amd64 and
runner_profile: developer-platform-xlarge-od) has handle_git: true and leave the
arm64 entry (arch: arm64) with handle_git: false so Branch/Commit/Push/Tag steps
guarded by matrix.handle_git run exactly once.

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds about right

@coderabbitai coderabbitai Bot Mar 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nadav-t, glad we're aligned! Here's the fix to apply — only the amd64 entry should drive git operations so the release branch, tag, and merge-to-develop run exactly once:

         - arch: amd64
           runner_profile: developer-platform-xlarge-od
           tag_suffix: ""
           platform_info: ""
-          handle_git: false
+          handle_git: true
         - arch: arm64
           runner_profile: renovate-arm-od
           tag_suffix: "-arm64"
           platform_info: "ARM64"
           handle_git: false

This ensures the Branch, Commit, Push and Tag Changes step (guarded by if: matrix.handle_git == true) executes exactly once — on the amd64 runner — restoring the pre-PR behaviour.

🧠 Learnings used 
Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to repo-integrations/**/Dockerfile* : Base images must contain only open-source tools, no proprietary Mend code

Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to repo-integrations/**/Dockerfile* : All source Dockerfiles must have `# END OF BASE IMAGE` comment to mark truncation point


steps:
- name: Check out code
uses: actions/checkout@v3

@coderabbitai coderabbitai Bot Feb 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

actions/checkout v4 release current version recommended 2024 2025

💡 Result:

  • Latest overall actions/checkout (as of Feb 22, 2026): v6.0.2 (released Jan 9, 2026). [1]
  • Latest in the v4 major line: v4.3.0 (released Aug 11, 2025). [2][3]
  • v4 major release date: v4.0.0 was released Oct 17, 2023. [3]

What’s recommended (2024–2025 and now):

  • If you’re still on v4, the recommended “current v4” to target is actions/checkout@v4 (it moves to the latest v4.x, currently v4.3.0). [2][3]
  • For new/upgraded workflows, prefer the latest major (actions/checkout@v6, currently v6.0.2). [1]
  • Security best practice (2024–2025+): pin actions to a full commit SHA (optionally with a comment like # v4.3.0) rather than only @v4/@v6. [4] GitHub also added policy support to enforce SHA pinning. [5]

Sources:
[1] https://github.com/actions/checkout/releases/tag/v6.0.2
[2] https://github.com/actions/checkout/releases/tag/v4.3.0
[3] https://releasealert.dev/github/actions/checkout
[4] https://wellarchitected.github.com/library/application-security/recommendations/actions-security/
[5] https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/

🌐 Web query:

actionlint actions/checkout v3 v4 deprecation support

💡 Result:

  • actions/checkout@v3 isn’t “deprecated” by itself, but it runs on the Node.js 16 action runtime, and GitHub has been transitioning Actions from Node 16 to Node 20, showing warnings for workflows that still use Node16-based actions and encouraging upgrades to Node20-based major versions (like checkout@v4). [1]
  • actions/checkout@v4 is the Node20-based major version and is the recommended upgrade target to eliminate Node16 deprecation warnings. [2]
  • actionlint supports workflows using actions/checkout@v4 (it’s used in actionlint’s own examples). [3]
  • If actionlint is complaining about checkout@v4 inputs/outputs, update actionlint—it periodically refreshes its “popular actions” metadata used for action-usage checking. Recent releases explicitly mention updating this dataset. [4]

Sources
[1] GitHub Changelog: “GitHub Actions: Transitioning from Node 16 to Node 20” (Sep 22, 2023). (github.blog)
[2] Example discussion noting checkout@v3 uses node16 and should upgrade to v4. (github.com)
[3] actionlint repo README example uses actions/checkout@v4. (github.com)
[4] actionlint releases note: “Update the popular actions data set to the latest.” (github.com)

Citations:

Upgrade actions/checkout@v3 to v4 — v3 runs on the deprecated Node 16 runtime, while v4 is Node 20-based and currently maintained (latest v4.3.0).

-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/checkout@v3
uses: actions/checkout@v4
🧰 Tools
🪛 actionlint (1.7.11)

[error] 52-52: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/stg-from-version-build-push-tag-base-image.yaml at line
52, The workflow uses an outdated checkout action version; update the uses
reference "uses: actions/checkout@v3" to the maintained Node-20-based v4 (e.g.,
"uses: actions/checkout@v4" or pin to "actions/checkout@v4.3.0") so the job no
longer runs on the deprecated Node 16 runtime.

with:
ref: "main"
ref: ${{ github.ref }}

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

make sure it's main

fetch-depth: 0

- name: Configure AWS credentials
Expand Down Expand Up @@ -72,26 +87,27 @@ jobs:
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Build Docker Images
- name: Build Docker Images (${{ matrix.arch }})
env:
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
run: |
echo "🔨 Starting Docker build process..."
./bin/build.sh "${{ github.event.inputs.Tag }}" "$ECR_REGISTRY" "${{ github.event.inputs.CopyVersionScript }}"
echo "✅ Docker build completed successfully"
echo "🔨 Starting ${{ matrix.arch }} Docker build process..."
./bin/build.sh "${{ github.event.inputs.Tag }}" "$ECR_REGISTRY" "${{ github.event.inputs.CopyVersionScript }}" "${{ matrix.tag_suffix }}"
echo "✅ ${{ matrix.arch }} Docker build completed successfully"
shell: bash

- name: Publish to ECR
- name: Publish to ECR (${{ matrix.arch }})
env:
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
run: |
echo "📤 Starting ECR publish process..."
./bin/publish.sh "${{ github.event.inputs.Tag }}" "$ECR_REGISTRY"
echo "✅ ECR publish completed successfully"
echo "📤 Starting ${{ matrix.arch }} ECR publish process..."
./bin/publish.sh "${{ github.event.inputs.Tag }}" "$ECR_REGISTRY" "${{ matrix.tag_suffix }}"
echo "✅ ${{ matrix.arch }} ECR publish completed successfully"
shell: bash

- name: Branch, Commit, Push and Tag Changes
if: matrix.handle_git == true
env:
GH_TOKEN: ${{ github.token }}
run: |
Expand Down Expand Up @@ -138,11 +154,11 @@ jobs:
git push
shell: bash

- name: Notify Slack - Images Ready
if: always() && github.event.inputs.TriggeredBy != 'ubuntu-refresh'
env:
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
SLACK_WEBHOOK_URL: ${{ secrets.STG_SLACK_WEBHOOK_URL }}
run: |
echo "📤 Sending Slack notification..."
./bin/notify-slack.sh "${{ github.event.inputs.Tag }}" "${{ job.status }}" "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
# - name: Notify Slack - Images Ready (${{ matrix.arch }})
# if: always() && github.event.inputs.TriggeredBy != 'ubuntu-refresh'
# env:
# ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
# SLACK_WEBHOOK_URL: ${{ secrets.STG_SLACK_WEBHOOK_URL }}
# run: |
# echo "📤 Sending Slack notification for ${{ matrix.arch }}..."
# ./bin/notify-slack.sh "${{ github.event.inputs.Tag }}" "${{ job.status }}" "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" "${{ matrix.platform_info }}"
Comment on lines +157 to +164

@coderabbitai coderabbitai Bot Feb 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Slack notification is fully commented out — no build status notifications will be sent.

The previous workflow notified Slack on every run (with if: always()). With this block commented out, the team loses visibility into build successes and failures. If this is intentional for the WIP phase, consider adding a TODO or tracking issue so it isn't forgotten before merging to main.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/stg-from-version-build-push-tag-base-image.yaml around
lines 157 - 164, The Slack notification step ("Notify Slack - Images Ready (${{
matrix.arch }})") has been fully commented out; restore or make explicit the
intended behavior by uncommenting the step (including the if: always() &&
github.event.inputs.TriggeredBy != 'ubuntu-refresh', env entries ECR_REGISTRY
and SLACK_WEBHOOK_URL, and the run block that calls ./bin/notify-slack.sh with
the Tag, job.status, run URL and matrix.platform_info), or replace it with a
no-op plus a clear TODO/issue reference so the omission isn't forgotten before
merge; ensure the restored step preserves the original condition and parameters.

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why not?

@coderabbitai coderabbitai Bot Mar 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nadav-t, the concern is about losing build-status visibility for the team — the previous workflow always sent a Slack notification (success or failure) after every run. Now that it's commented out, no notifications will be sent at all.

That said, there's a likely valid reason here: with the new matrix strategy (amd64 + arm64), the notification step would fire twice per workflow trigger — once for each arch — which could be noisy or confusing. That's a reasonable motivation to temporarily suppress it while figuring out the right approach (e.g., send one aggregated notification, or only notify from the handle_git: true arch when that's eventually enabled).

The flag is simply a reminder that commenting it out entirely means no failure alerts either, which is a regression in observability. If this is intentional for the WIP phase, a short comment like # TODO: re-enable once matrix notification strategy is decided would make the intent clear to reviewers and prevent it from being forgotten before the PR merges to main.

🧠 Learnings used 
Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to repo-integrations/**/Dockerfile* : Base images must contain only open-source tools, no proprietary Mend code

Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to repo-integrations/**/Dockerfile* : All source Dockerfiles must have `# END OF BASE IMAGE` comment to mark truncation point

31 changes: 16 additions & 15 deletions bin/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ set -e
RELEASE=$1
REGISTRY_PREFIX=$2
COPY_VERSIONS_JSON=$3
TAG_SUFFIX=$4 # Optional: "-arm64" or empty for AMD64

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably need to update based on main



if [ -z "$RELEASE" ]; then
Expand Down Expand Up @@ -32,41 +33,41 @@ echo "Building images with registry prefix: ${REGISTRY_PREFIX}"
docker pull ubuntu:24.04


docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-scanner-sast:${RELEASE} -f repo-integrations/scanner/DockerfileSast .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-controller:${RELEASE} -f repo-integrations/controller/Dockerfile .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-remediate:${RELEASE} -f repo-integrations/remediate/Dockerfile .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE} -f repo-integrations/scanner/Dockerfile .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}-full -f repo-integrations/scanner/Dockerfile.full .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-scanner-sast:${RELEASE}${TAG_SUFFIX} -f repo-integrations/scanner/DockerfileSast .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-controller:${RELEASE}${TAG_SUFFIX} -f repo-integrations/controller/Dockerfile .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-remediate:${RELEASE}${TAG_SUFFIX} -f repo-integrations/remediate/Dockerfile .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}${TAG_SUFFIX} -f repo-integrations/scanner/Dockerfile .
docker build --no-cache -t ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}${TAG_SUFFIX}-full -f repo-integrations/scanner/Dockerfile.full .


#Validate built images successfully created
echo "🔍 Validating built images..."
if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-scanner-sast:${RELEASE} 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-scanner-sast:${RELEASE} was not built successfully"
if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-scanner-sast:${RELEASE}${TAG_SUFFIX} 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-scanner-sast:${RELEASE}${TAG_SUFFIX} was not built successfully"

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it might be already part of the release tag make sure to take main, if not then looks fine

exit 1
fi
echo "✅ SAST scanner image validated"

if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-controller:${RELEASE} 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-controller:${RELEASE} was not built successfully"
if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-controller:${RELEASE}${TAG_SUFFIX} 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-controller:${RELEASE}${TAG_SUFFIX} was not built successfully"
exit 1
fi
echo "✅ Controller image validated"

if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-remediate:${RELEASE} 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-remediate:${RELEASE} was not built successfully"
if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-remediate:${RELEASE}${TAG_SUFFIX} 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-remediate:${RELEASE}${TAG_SUFFIX} was not built successfully"
exit 1
fi
echo "✅ Remediate image validated"

if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE} 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE} was not built successfully"
if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}${TAG_SUFFIX} 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}${TAG_SUFFIX} was not built successfully"
exit 1
fi
echo "✅ SCA scanner image validated"

if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}-full 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}-full was not built successfully"
if [ -z "$(docker images -q ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}${TAG_SUFFIX}-full 2> /dev/null)" ]; then
echo "❌ ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}${TAG_SUFFIX}-full was not built successfully"
exit 1
fi

Expand Down
5 changes: 4 additions & 1 deletion bin/copy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ if ! grep -q "# END OF BASE IMAGE" repo-integrations/scanner/Dockerfile.full; th
exit 1
fi

apply_dockerfile_modifications "repo-integrations/scanner/Dockerfile.full" "scanner"

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it might be wrong - both files using scanner

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see you changed the txt files . not sure why, it would break updates for both type of files.
Anyway the arm should be supported for both scanner files so I'm not sure what you gain, probably it's exactly the same changes.

apply_dockerfile_modifications "repo-integrations/scanner/Dockerfile.full" "scanner-full"
if [ "$COPY_VERSIONS_JSON" = true ]; then
append_scanner_script_support "repo-integrations/scanner/Dockerfile.full"
fi
Expand All @@ -139,6 +139,9 @@ if [ ! -f $remediateDockerfile ]; then
fi

sed '/# END OF BASE IMAGE/ q' $remediateDockerfile > repo-integrations/remediate/Dockerfile

apply_dockerfile_modifications "repo-integrations/remediate/Dockerfile" "remediate"

# ================================
# SUMMARY OUTPUT
# ================================
Expand Down
15 changes: 10 additions & 5 deletions bin/modify-dockerfile.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,11 +35,13 @@ modify_dockerfile() {
case "$action" in
"REMOVE")
# Remove lines matching pattern
sed -i.bak "/${pattern}/d" "$temp_file"
# Use @ as delimiter to avoid conflicts with / in paths and | in pipes
sed -i.bak "\\@${pattern}@d" "$temp_file"
;;
"COMMENT")
# Comment out lines matching pattern - simple single line
sed -i.bak "s/^\(.*${pattern}.*\)$/# \1/" "$temp_file"
# Use @ as delimiter to avoid conflicts with / in paths and | in pipes
sed -i.bak "s@^\(.*${pattern}.*\)$@# \1@" "$temp_file"

@coderabbitai coderabbitai Bot Feb 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

$@ in the double-quoted sed expression corrupts the COMMENT action — SC2145 is not a false positive.

The string "s@^\(.*${pattern}.*\)$@# \1@" contains \)$@ where bash parses $@ as the "all positional parameters" special variable. Inside modify_dockerfile(), $@ is the two function arguments (Dockerfile path + commands-file path). Bash splits this into two separate words:

  • word 1: "s@^\(.*<pattern>.*\)<dockerfile_path>"
  • word 2: "<commands_file_path># \1@"

sed receives two garbled arguments instead of a single valid expression, so every COMMENT action silently fails or produces wrong output.

Fix by using mixed quoting so $@ is never interpreted by the shell:

🐛 Proposed fix 
-                sed -i.bak "s@^\(.*${pattern}.*\)$@# \1@" "$temp_file"
+                sed -i.bak 's@^\(.*'"${pattern}"'.*\)$@# \1@' "$temp_file"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
sed -i.bak "s@^\(.*${pattern}.*\)$@# \1@" "$temp_file"
sed -i.bak 's@^\(.*'"${pattern}"'.*\)$@# \1@' "$temp_file"
🧰 Tools
🪛 Shellcheck (0.11.0)

[error] 44-44: Argument mixes string and array. Use * or separate argument.

(SC2145)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@bin/modify-dockerfile.sh` at line 44, In modify_dockerfile the sed expression
sed -i.bak "s@^\(.*${pattern}.*\)$@# \1@" "$temp_file" is broken because the
double-quoted string contains $@ which the shell expands; change the quoting so
the sed script is a single argument and ${pattern} is still expanded (for
example use mixed quoting: wrap the sed script in single quotes and inject the
expanded ${pattern} with "'${pattern}'" or similar), leaving "$temp_file" as a
separate quoted argument; ensure the unique symbols mentioned (modify_dockerfile
and the sed invocation) are updated so the shell never sees $@ inside the sed
script.

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure why changing this - need to be careful not to break existing comments. Once you take the main, you will see a few more was added.

@coderabbitai coderabbitai Bot Mar 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nadav-t, thanks for the context — let me clarify why this matters.

The original code using / as delimiter was actually fine:

sed -i.bak "s/^\(.*${pattern}.*\)$/# \1/" "$temp_file"

There's no $@ risk here because the delimiter is /.

The new code that changed to @ introduced a subtle bash expansion bug:

sed -i.bak "s@^\(.*${pattern}.*\)$@# \1@" "$temp_file"

Inside a double-quoted string, bash sees \)$@ and expands $@ as the function's positional parameters — i.e., the dockerfile path and commands-file path get spliced into the middle of the sed expression. This causes sed to receive garbled arguments, silently breaking every COMMENT action.

The fix with mixed quoting keeps the @ delimiter (which is useful for patterns with / in them) while preventing the unintended $@ expansion:

sed -i.bak 's@^\(.*'"${pattern}"'.*\)$@# \1@' "$temp_file"

Here $@ sits inside single quotes and is never touched by bash, while ${pattern} is still correctly expanded via the inner double-quoted segment.

🧠 Learnings used 
Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to config/*-modifications.txt : Dockerfile modification system uses format ACTION:PATTERN:REPLACEMENT in configuration files. Actions include: COMMENT, COMMENT_PAIR, COMMENT_BLOCK, REMOVE, REPLACE, ADD_AFTER, ADD_BEFORE

Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to config/*-modifications.txt : Use COMMENT_BLOCK action to comment out entire multi-line RUN blocks (searches for pattern in comments or RUN commands)

Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to config/*-modifications.txt : Use COMMENT_PAIR action for `ARG + RUN` version pairs - comment out matched line and immediately following non-empty line only when both match their respective patterns

Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to repo-integrations/**/Dockerfile* : Base images must contain only open-source tools, no proprietary Mend code

Learnt from: CR
Repo: mend/docker-base-images PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-17T00:07:50.932Z
Learning: Applies to repo-integrations/**/Dockerfile* : All source Dockerfiles must have `# END OF BASE IMAGE` comment to mark truncation point

;;
"COMMENT_BLOCK")
# Comment out multi-line blocks - handle both pattern in RUN line and in preceding comments
Expand Down Expand Up @@ -128,17 +130,20 @@ EOF
;;
"ADD_AFTER")
# Add replacement after line matching pattern
sed -i.bak "/${pattern}/a\\
# Use @ as delimiter to avoid conflicts with / in paths and | in pipes
sed -i.bak "\\@${pattern}@a\\
${replacement}" "$temp_file"
;;
"ADD_BEFORE")
# Add replacement before line matching pattern
sed -i.bak "/${pattern}/i\\
# Use @ as delimiter to avoid conflicts with / in paths and | in pipes
sed -i.bak "\\@${pattern}@i\\
${replacement}" "$temp_file"
;;
"REPLACE")
# Replace entire line matching pattern
sed -i.bak "s/.*${pattern}.*/${replacement}/" "$temp_file"
# Use @ as delimiter to avoid conflicts with / in paths and | in pipes

@nadav-t nadav-t Mar 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same as above

sed -i.bak "s@.*${pattern}.*@${replacement}@" "$temp_file"
;;
*)
echo " Warning: Unknown action '$action', skipping"
Expand Down
28 changes: 19 additions & 9 deletions bin/notify-slack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,16 @@ set -e
VERSION=$1
JOB_STATUS=$2
WORKFLOW_URL=$3
PLATFORM_INFO=$4 # Optional: "ARM64" or empty

# Set platform prefix and tag suffix if platform info provided
PLATFORM_PREFIX=""
PLATFORM_TAG_SUFFIX=""

if [ -n "$PLATFORM_INFO" ]; then
PLATFORM_PREFIX="[${PLATFORM_INFO}] "
PLATFORM_TAG_SUFFIX="-arm64"
fi

# Determine status emoji and message
if [ "$JOB_STATUS" = "success" ]; then
Expand All @@ -26,25 +36,25 @@ fi
if [ "$JOB_STATUS" = "success" ]; then
READY_MESSAGE="ready Images"
IMAGES="
• \`$ECR_REGISTRY/base-repo-controller:$VERSION\`
• \`$ECR_REGISTRY/base-repo-scanner:$VERSION\`
• \`$ECR_REGISTRY/base-repo-scanner:$VERSION-full\`
• \`$ECR_REGISTRY/base-repo-scanner-sast:$VERSION\`
• \`$ECR_REGISTRY/base-repo-remediate:$VERSION\`"
• \`$ECR_REGISTRY/base-repo-controller:$VERSION${PLATFORM_TAG_SUFFIX}\`
• \`$ECR_REGISTRY/base-repo-scanner:$VERSION${PLATFORM_TAG_SUFFIX}\`
• \`$ECR_REGISTRY/base-repo-scanner:$VERSION${PLATFORM_TAG_SUFFIX}-full\`
• \`$ECR_REGISTRY/base-repo-scanner-sast:$VERSION${PLATFORM_TAG_SUFFIX}\`
• \`$ECR_REGISTRY/base-repo-remediate:$VERSION${PLATFORM_TAG_SUFFIX}\`"

# Create success message
SLACK_MESSAGE="🚀 * Base Images Ready*
SLACK_MESSAGE="🚀 *${PLATFORM_PREFIX}Base Images Ready*

📦 *Tag:* \`$VERSION\`
📦 *Tag:* \`$VERSION${PLATFORM_TAG_SUFFIX}\`
📋 *Images Published:*$IMAGES

$STATUS_EMOJI All base images for services are now $READY_MESSAGE
🔗 Workflow: <$WORKFLOW_URL|View Run>"
else
# Create failure message
SLACK_MESSAGE="💥 * Base Images Pipeline $STATUS_MESSAGE*
SLACK_MESSAGE="💥 *${PLATFORM_PREFIX}Base Images Pipeline $STATUS_MESSAGE*

📦 *Tag:* \`$VERSION\`
📦 *Tag:* \`$VERSION${PLATFORM_TAG_SUFFIX}\`
$STATUS_EMOJI Pipeline failed during base images build/publish process

Please check the workflow logs for details:
Expand Down
11 changes: 6 additions & 5 deletions bin/publish.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ set -e

RELEASE=$1
REGISTRY_PREFIX=$2
TAG_SUFFIX=$3 # Optional: "-arm64" or empty

if [ -z "$RELEASE" ]; then
echo "Error: No release argument provided."
Expand All @@ -25,10 +26,10 @@ fi
echo "Pushing images to registry: ${REGISTRY_PREFIX}"

# Push all images directly
docker push ${REGISTRY_PREFIX}/base-repo-controller:${RELEASE}
docker push ${REGISTRY_PREFIX}/base-repo-remediate:${RELEASE}
docker push ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}
docker push ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}-full
docker push ${REGISTRY_PREFIX}/base-repo-scanner-sast:${RELEASE}
docker push ${REGISTRY_PREFIX}/base-repo-controller:${RELEASE}${TAG_SUFFIX}
docker push ${REGISTRY_PREFIX}/base-repo-remediate:${RELEASE}${TAG_SUFFIX}
docker push ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}${TAG_SUFFIX}
docker push ${REGISTRY_PREFIX}/base-repo-scanner:${RELEASE}${TAG_SUFFIX}-full
docker push ${REGISTRY_PREFIX}/base-repo-scanner-sast:${RELEASE}${TAG_SUFFIX}

echo "All images pushed successfully!"
5 changes: 3 additions & 2 deletions config/remediate-modifications.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# Configuration file for remediate Dockerfile modifications
# Format: ACTION:PATTERN:REPLACEMENT

# No changes required for remediate (as per your requirement)
# You can add modifications here if needed in the future
# Fix ARM64 compatibility: Remove amd64-specific base image reference
# This makes the base image multi-arch compatible (pulls correct arch automatically)
REPLACE:BASE_IMAGE=amd64:ARG BASE_IMAGE=ubuntu:24.04
24 changes: 24 additions & 0 deletions config/scanner-full-modifications.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# Configuration file for scanner Dockerfile.full modifications
# Format: ACTION:PATTERN:REPLACEMENT

# Comment out the entire mono installation block
COMMENT_BLOCK:Install Mono

# Comment out the entire nuget installation block
COMMENT_BLOCK:Install Nuget CLI

# Comment out only the specific nuget install line - precise and safe
COMMENT:apt-get install.*nuget

# ARM64 compatibility fixes (only for Dockerfile.full)

# Fix libssl package to use architecture-aware download
# Comment out both lines of the AMD64-specific block and add a new arch-aware RUN command
COMMENT:libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb
COMMENT: dpkg -i /tmp/libssl1.1.deb
ADD_AFTER: dpkg -i /tmp/libssl1.1.deb:RUN ARCH=$(uname -m); ARCH_SUFFIX=${ARCH/x86_64/amd64}; ARCH_SUFFIX=${ARCH_SUFFIX/aarch64/arm64} && curl -o /tmp/libssl1.1.deb "https://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_${ARCH_SUFFIX}.deb" && dpkg -i /tmp/libssl1.1.deb

# Fix Miniconda installer to use architecture-aware download
# Comment out the x86_64-specific line and add a new arch-aware one
COMMENT:Miniconda3-py39_24.1.2-0-Linux-x86_64.sh
ADD_AFTER:Miniconda3-py39_24.1.2-0-Linux-x86_64.sh: wget https://repo.anaconda.com/miniconda/Miniconda3-py39_24.1.2-0-Linux-$(uname -m).sh -O ${USER_HOME}/miniconda3/miniconda.sh && \\
6 changes: 0 additions & 6 deletions config/scanner-modifications.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,3 @@ COMMENT_BLOCK:Install Nuget CLI

# Comment out only the specific nuget install line - precise and safe
COMMENT:apt-get install.*nuget

# Example: Add a custom comment after the base image
# ADD_AFTER:FROM.*AS base:# Custom modifications applied

# Example: Replace a specific version
# REPLACE:ARG NODE_VERSION=.*:ARG NODE_VERSION=18.0.0