fix: fixed dockerfile vuln and updated build workflow

Author: emmabyte

.github/workflows/build-and-release.yaml

@@ -12,7 +12,6 @@ on:
 
 env:
     IMAGE_NAME: shawn636/mini-ftp
-    MINORS_TO_KEEP: 3
 
 jobs:
     build-and-release:
@@ -56,38 +55,35 @@ jobs:
               uses: docker/setup-buildx-action@v2
               with:
                   driver: docker-container
-                  buildkitd-flags: --allow-insecure-entitlement security.insecure
-
-            - name: Cache Docker Buildx
-              uses: actions/cache@v3
-              with:
-                  path: /tmp/.buildx-cache
-                  key: docker-buildx-cache-${{ runner.os }}-${{ github.sha }}
-                  restore-keys: |
-                      docker-buildx-cache-${{ runner.os }}-
 
             - name: Log in to Docker Hub
               uses: docker/login-action@v2
               with:
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
                   password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
 
-            - name: Build and Push Docker Image
+            - name: Build and Push Images
               run: |
                   VERSION=$(cat VERSION)
-                  echo "Building image with version: $VERSION"
+                  ALPINE_LATEST="latest"
+                  ALPINE_VERSIONS=("3.21" "3.20" "3.19")
+
+                  echo "Building and pushing images for version: $VERSION"
+
+                  # Build and push the default version (alpine:latest)
                   docker buildx build --push \
-                    --platform linux/amd64,linux/arm64 \
-                    --tag ${{ env.IMAGE_NAME }}:$VERSION \
-                    --cache-to type=inline \
-                    --cache-from type=registry,ref=${{ env.IMAGE_NAME }}:build-cache \
-                    .
+                      --platform linux/amd64,linux/arm64 \
+                      --tag ${{ env.IMAGE_NAME }}:$VERSION \
+                      --tag ${{ env.IMAGE_NAME }}:$VERSION-alpine-$ALPINE_LATEST \
+                      --build-arg ALPINE_VERSION=$ALPINE_LATEST .
 
-            - name: Cleanup Old Docker Images
-              run: |
-                  old_versions=$(docker images ${{ env.IMAGE_NAME }} --format '{{.Tag}}' | sort -r | tail -n +${{ env.MINORS_TO_KEEP }})
-                  for version in $old_versions; do
-                      docker rmi ${{ env.IMAGE_NAME }}:$version || true
+                  # Build and push for each specific Alpine version
+                  for version in "${ALPINE_VERSIONS[@]}"; do
+                      TAG_SUFFIX="alpine-$version"
+                      docker buildx build --push \
+                          --platform linux/amd64,linux/arm64 \
+                          --tag ${{ env.IMAGE_NAME }}:$VERSION-$TAG_SUFFIX \
+                          --build-arg ALPINE_VERSION=$version .
                   done
 
             - name: Finalize Release

Dockerfile

@@ -33,9 +33,23 @@ FROM $BASE_IMG
 COPY --from=pidproxy /usr/bin/pidproxy /usr/bin/pidproxy
 
 # Install runtime dependencies
-RUN apk --no-cache add vsftpd tini bash shadow jq curl \
-    && curl -sL $(curl -s https://api.github.com/repos/mikefarah/yq/releases/latest | jq -r '.assets[] | select(.name | contains("linux_amd64")) | .browser_download_url') -o /usr/bin/yq \
-    && chmod +x /usr/bin/yq
+RUN apk --no-cache add vsftpd tini bash shadow jq curl
+
+# Install yq
+# Install yq dynamically based on architecture
+RUN arch=$(uname -m) \
+    && case "$arch" in \
+    x86_64)   yq_arch="yq_linux_amd64";; \
+    aarch64)  yq_arch="yq_linux_arm64";; \
+    armv7l)   yq_arch="yq_linux_arm";; \
+    *)        echo "Unsupported architecture: $arch"; exit 1;; \
+    esac \
+    && curl -sL https://github.com/mikefarah/yq/releases/latest/download/$yq_arch -o /usr/bin/yq \
+    && chmod +x /usr/bin/yq \
+    # Verify yq version is at least 4.44.0
+    && yq_version=$(yq --version | awk '{print $3}') \
+    && min_version="4.44.0" \
+    && [ "$(printf '%s\n' "$min_version" "$yq_version" | sort -V | head -n1)" = "$min_version" ] || { echo "yq version must be >= 4.44.0. Found $yq_version"; exit 1; }
 
 COPY config/vsftpd.conf /etc/vsftpd/vsftpd.conf