Skip to content

Commit c3a5846

Browse files
anthony-nhsanthony-nhs
committed
initial commit
0 parents  commit c3a5846

19 files changed

+862
-0
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
2+
ARG TARGETARCH
3+
ENV TARGETARCH=${TARGETARCH}
4+
5+
# Install essential packages first
6+
RUN apt-get update && apt-get install -y \
7+
curl \
8+
wget \
9+
git \
10+
sudo \
11+
unzip \
12+
&& apt-get clean \
13+
&& rm -rf /var/lib/apt/lists/*
14+
15+
# Copy ASDF version file
16+
ARG ASDF_VERSION
17+
COPY .tool-versions.asdf /tmp/.tool-versions.asdf
18+
19+
# Add amd64 architecture if on arm64
20+
RUN if [ "$TARGETARCH" == "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then dpkg --add-architecture amd64; fi
21+
22+
RUN apt-get update \
23+
&& export DEBIAN_FRONTEND=noninteractive \
24+
&& apt-get -y dist-upgrade \
25+
&& apt-get -y install --no-install-recommends htop vim curl git build-essential \
26+
libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev libbz2-dev \
27+
zlib1g-dev unixodbc unixodbc-dev libsecret-1-0 libsecret-1-dev libsqlite3-dev \
28+
jq apt-transport-https ca-certificates gnupg-agent \
29+
software-properties-common bash-completion python3-pip make libbz2-dev \
30+
libreadline-dev libsqlite3-dev wget llvm libncurses5-dev libncursesw5-dev \
31+
xz-utils tk-dev liblzma-dev netcat-traditional libyaml-dev uuid-runtime xxd unzip
32+
33+
# install aws stuff
34+
# Download correct AWS CLI for arch
35+
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
36+
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip"; \
37+
else \
38+
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"; \
39+
fi && \
40+
unzip /tmp/awscliv2.zip -d /tmp/aws-cli && \
41+
/tmp/aws-cli/aws/install && \
42+
rm /tmp/awscliv2.zip && rm -rf /tmp/aws-cli
43+
44+
# Install ASDF
45+
RUN ASDF_VERSION=$(awk '!/^#/ && NF {print $1; exit}' /tmp/.tool-versions.asdf) && \
46+
if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
47+
wget -O /tmp/asdf.tar.gz "https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-arm64.tar.gz"; \
48+
else \
49+
wget -O /tmp/asdf.tar.gz "https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-amd64.tar.gz"; \
50+
fi && \
51+
tar -xzf /tmp/asdf.tar.gz -C /tmp && \
52+
mkdir -p /usr/bin && \
53+
mv /tmp/asdf /usr/bin/asdf && \
54+
chmod +x /usr/bin/asdf && \
55+
rm -rf /tmp/asdf.tar.gz
56+
57+
# install gitsecrets
58+
RUN git clone https://github.com/awslabs/git-secrets.git /tmp/git-secrets && \
59+
cd /tmp/git-secrets && \
60+
make install && \
61+
cd && \
62+
rm -rf /tmp/git-secrets && \
63+
mkdir -p /usr/share/secrets-scanner && \
64+
chmod 755 /usr/share/secrets-scanner && \
65+
curl -L https://raw.githubusercontent.com/NHSDigital/software-engineering-quality-framework/main/tools/nhsd-git-secrets/nhsd-rules-deny.txt -o /usr/share/secrets-scanner/nhsd-rules-deny.txt
66+
67+
USER vscode
68+
69+
ENV PATH="/home/vscode/.asdf/shims/:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"
70+
RUN \
71+
echo 'PATH="/home/vscode/.asdf/shims/:$PATH:/workspaces/eps-devcontainers/node_modules/.bin"' >> ~/.bashrc; \
72+
echo '. <(asdf completion bash)' >> ~/.bashrc; \
73+
echo '# Install Ruby Gems to ~/gems' >> ~/.bashrc; \
74+
echo 'export GEM_HOME="$HOME/gems"' >> ~/.bashrc; \
75+
echo 'export PATH="$HOME/gems/bin:$PATH"' >> ~/.bashrc;
76+
77+
# Install ASDF plugins
78+
RUN asdf plugin add python; \
79+
asdf plugin add poetry https://github.com/asdf-community/asdf-poetry.git; \
80+
asdf plugin add shellcheck https://github.com/luizm/asdf-shellcheck.git; \
81+
asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git; \
82+
asdf plugin add direnv; \
83+
asdf plugin add actionlint; \
84+
asdf plugin add ruby https://github.com/asdf-vm/asdf-ruby.git; \
85+
asdf plugin add trivy https://github.com/zufardhiyaulhaq/asdf-trivy.git
86+
87+
88+
WORKDIR /workspaces/eps-devcontainers
89+
COPY .tool-versions /workspaces/eps-devcontainers/.tool-versions
90+
COPY .tool-versions /home/vscode/.tool-versions
91+
92+
# install python before poetry to ensure correct python version is used
93+
RUN asdf install python; \
94+
asdf install
95+
96+
RUN git-secrets --register-aws --global && \
97+
git-secrets --add-provider --global -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt

‎.devcontainer/devcontainer.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
2+
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
3+
{
4+
"name": "Ubuntu",
5+
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
6+
"build": {
7+
"dockerfile": "Dockerfile",
8+
"context": "..",
9+
"args": {}
10+
},
11+
"mounts": [
12+
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
13+
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",
14+
"source=${env:HOME}${env:USERPROFILE}/.gnupg,target=/home/vscode/.gnupg,type=bind",
15+
"source=${env:HOME}${env:USERPROFILE}/.npmrc,target=/home/vscode/.npmrc,type=bind"
16+
],
17+
"runArgs": [
18+
"--network=host"
19+
],
20+
"remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" },
21+
"postAttachCommand": "docker build -f https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/tags/v4.0.4/dockerfiles/nhsd-git-secrets.dockerfile -t git-secrets . && poetry run pre-commit install --install-hooks -f",
22+
"features": {
23+
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
24+
"version": "latest",
25+
"moby": "true",
26+
"installDockerBuildx": "true"
27+
},
28+
"ghcr.io/devcontainers/features/github-cli:1": {}
29+
},
30+
"customizations": {
31+
"vscode": {
32+
"extensions": [
33+
"AmazonWebServices.aws-toolkit-vscode",
34+
"redhat.vscode-yaml",
35+
"ms-python.python",
36+
"ms-python.flake8",
37+
"eamodio.gitlens",
38+
"github.vscode-pull-request-github",
39+
"orta.vscode-jest",
40+
"42crunch.vscode-openapi",
41+
"mermade.openapi-lint",
42+
"christian-kohler.npm-intellisense",
43+
"dbaeumer.vscode-eslint",
44+
"lfm.vscode-makefile-term",
45+
"GrapeCity.gc-excelviewer",
46+
"redhat.vscode-xml",
47+
"streetsidesoftware.code-spell-checker",
48+
"timonwong.shellcheck",
49+
"mkhl.direnv",
50+
"github.vscode-github-actions",
51+
"Gruntfuggly.todo-tree",
52+
"ms-vscode.makefile-tools"
53+
],
54+
"settings": {
55+
"python.defaultInterpreterPath": "/workspaces/eps-devcontainers/.venv/bin/python",
56+
"python.analysis.autoSearchPaths": true,
57+
"python.analysis.extraPaths": [],
58+
"python.testing.unittestEnabled": false,
59+
"python.testing.pytestEnabled": true,
60+
"pylint.enabled": false,
61+
"python.linting.flake8Enabled": true,
62+
"python.linting.enabled": true, // required to format on save
63+
"editor.formatOnPaste": false, // required
64+
"editor.formatOnType": false, // required
65+
"editor.formatOnSave": true, // optional
66+
"editor.formatOnSaveMode": "file",
67+
"cSpell.words": ["fhir", "Formik", "pino", "serialisation"],
68+
"editor.defaultFormatter": "dbaeumer.vscode-eslint"
69+
70+
},
71+
"eslint.useFlatConfig": true,
72+
"eslint.format.enable": true
73+
}
74+
},
75+
"postCreateCommand": "rm -f ~/.docker/config.json; git config --global --add safe.directory /workspaces/eps-devcontainers; make install; direnv allow ."
76+
// "features": {},
77+
// Use 'forwardPorts' to make a list of ports inside the container available locally.
78+
// "forwardPorts": [],
79+
// Use 'postCreateCommand' to run commands after the container is created.
80+
// "postCreateCommand": ""
81+
// Configure tool-specific properties.
82+
// "customizations": {},
83+
// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
84+
// "remoteUser": "root"
85+
}
86+

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
node_modules/
2+
.venv/
3+
src/base/.devcontainer/language_versions/

‎.pre-commit-config.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v5.0.0
4+
hooks:
5+
- id: check-merge-conflict
6+
name: Check for merge conflict strings
7+
8+
- id: end-of-file-fixer
9+
name: Fix missing newline at the end of files
10+
11+
- id: check-shebang-scripts-are-executable
12+
name: Check shell scripts are executable
13+
files: \.(sh)$
14+
15+
- id: check-yaml
16+
name: Check pipelines configuration
17+
files: ^(.github)
18+
19+
- repo: https://github.com/pycqa/flake8
20+
rev: "7ef0350a439c93166bc8ba89fcc3de6a9a664e6c" # release 6.1.0
21+
hooks:
22+
- id: flake8
23+
24+
- repo: local
25+
hooks:
26+
- id: lint-githubactions
27+
name: Lint github actions
28+
entry: make
29+
args: ["lint-githubactions"]
30+
language: system
31+
files: ^.github
32+
types_or: [yaml]
33+
pass_filenames: false
34+
35+
- id: lint-githubaction-scripts
36+
name: Lint github action scripts
37+
entry: make
38+
args: ["lint-githubaction-scripts"]
39+
language: system
40+
files: ^.github/scripts
41+
types_or: [sh, shell]
42+
pass_filenames: false
43+
44+
- id: git-secrets
45+
name: Git Secrets
46+
description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
47+
entry: bash
48+
args:
49+
- -c
50+
- 'git-secrets --pre_commit_hook'
51+
language: system
52+
53+
fail_fast: true
54+
default_stages: [pre-commit]

‎.tool-versions‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
nodejs 24.12.0
2+
python 3.14.2
3+
poetry 2.2.1
4+
shellcheck 0.11.0
5+
direnv 2.37.1
6+
actionlint 1.7.10
7+
ruby 3.3.0
8+
trivy 0.68.2

‎.tool-versions.asdf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# define the .asdf-version to use here
2+
0.18.0

‎Makefile‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
CONTAINER_PREFIX=ghcr.io/nhsdigital/eps-devcontainer-
2+
CONTAINER_NAME=base
3+
IMAGE_NAME=${CONTAINER_PREFIX}$(CONTAINER_NAME)
4+
WORKSPACE_FOLDER=.
5+
6+
install: install-python install-node install-hooks
7+
8+
install-python:
9+
poetry install
10+
11+
install-node:
12+
npm install
13+
14+
install-hooks: install-python
15+
poetry run pre-commit install --install-hooks --overwrite
16+
17+
install-hooks:
18+
build-base-image: generate-language-version-files
19+
CONTAINER_NAME=$(CONTAINER_NAME) \
20+
devcontainer build \
21+
--workspace-folder ./src/base/ \
22+
--push false \
23+
--image-name "${IMAGE_NAME}"
24+
25+
generate-language-version-files:
26+
./scripts/generate_language_version_files.sh
27+
28+
scan-base-image:
29+
trivy image \
30+
--severity HIGH,CRITICAL \
31+
--ignorefile .trivyignore.yaml \
32+
--exit-code 1 \
33+
--format table ${IMAGE_NAME}

‎package-lock.json‎

Lines changed: 28 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"name": "eps-devcontainers",
3+
"version": "1.0.0",
4+
"main": "index.js",
5+
"scripts": {
6+
"test": "echo \"Error: no test specified\" && exit 1"
7+
},
8+
"author": "",
9+
"license": "ISC",
10+
"description": "",
11+
"dependencies": {
12+
"@devcontainers/cli": "^0.80.3"
13+
}
14+
}

0 commit comments

Comments
 (0)