Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: setup for the project #172

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

Paras-Wednesday
Copy link

@Paras-Wednesday Paras-Wednesday commented Jun 25, 2024

Ticket Link


Related Links


Description


  • Bump the strmangle dependency from v0.0.4 to v0.0.6
  • Remove the sqlboiler v3, only v4 should be used in the project
  • Update README for clean instructions on the seeding the entities
  • Update Dockerfile
    • The docker build will now be quicker due to the caching of dependency download

Steps to Reproduce / Test


make tests

Request


Response


Summary by CodeRabbit

  • Chores

    • Reordered and added steps in the Dockerfile for better dependency management.
  • Documentation

    • Reorganized README.md content for improved clarity.
    • Updated instructions for setting up the database and running migrations.
    • Enhanced formatting for code snippets and commands.

- Bump the strmangle dependency from `v0.0.4` to `v0.0.6`
- Remove the `sqlboiler` v3, only v4 should be used in the project
- Update README for clean instructions on the `seeding` the entities
- Update Dockerfile
  - The docker build will now be quicker due to the caching of
dependency download
Copy link

coderabbitai bot commented Jun 25, 2024

Walkthrough

The recent updates focus on optimizing the Dockerfile by reordering the steps for dependency management and enhancing the clarity and usability of the README.md file through content restructuring, removing redundancies, and improving formatting for better readability. These changes streamline the build process and setup instructions, ensuring a more efficient and user-friendly experience.

Changes

File Change Summary
Dockerfile Reordered steps for dependency management: replaced RUN mkdir /app with WORKDIR /app, added steps to copy go.mod and go.sum before running go mod download, repositioned ADD . /app.
README.md Reorganized content for clarity, removed redundant div tags, updated database setup and migration instructions, enhanced formatting for code snippets and commands.

Poem

In the realm of code, changes flow,
Docker steps refined to make it grow,
Dependencies now first in line,
The build process is so divine.
Documented clear, with a helpful tweak,
Efficiency at its peak.


Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share
Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai generate interesting stats about this repository and render them as a table.
    • @coderabbitai show all the console.log statements in this repository.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (invoked as PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Configration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

Outside diff range and nitpick comments (3)
Dockerfile (2)

Line range hint 22-25: Consider consolidating multiple RUN instructions.

Multiple consecutive RUN instructions can be combined to reduce the number of layers in the Docker image.

- RUN go run ./cmd/seeder/main.go
- RUN go build -o ./output/server ./cmd/server/main.go
- RUN go build -o ./output/migrations ./cmd/migrations/main.go
- RUN go build  -o ./output/seeder ./cmd/seeder/exec/seed.go
+ RUN go run ./cmd/seeder/main.go && \
+    go build -o ./output/server ./cmd/server/main.go && \
+    go build -o ./output/migrations ./cmd/migrations/main.go && \
+    go build -o ./output/seeder ./cmd/seeder/exec/seed.go
Tools
Hadolint

[warning] 2-2: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 2-2: Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages (DL3019)


[error] 7-7: Use COPY instead of ADD for files and folders (DL3020)


[error] 8-8: Use COPY instead of ADD for files and folders (DL3020)


[error] 12-12: Use COPY instead of ADD for files and folders (DL3020)


Line range hint 28-28: Pin the Alpine version explicitly.

Using latest for the Alpine version can lead to unpredictable builds if the image updates.

- FROM alpine:latest
+ FROM alpine:<specific-version>
Tools
Hadolint

[warning] 2-2: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 2-2: Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages (DL3019)


[error] 7-7: Use COPY instead of ADD for files and folders (DL3020)


[error] 8-8: Use COPY instead of ADD for files and folders (DL3020)


[error] 12-12: Use COPY instead of ADD for files and folders (DL3020)

README.MD (1)

Line range hint 1-1: Add alternate text to images.

Images should have alternate text to improve accessibility and SEO.

- <img src="https://github.com/wednesday-solutions/go-template/blob/master/golang_template_github.svg" width="440" height="480" />
+ <img src="https://github.com/wednesday-solutions/go-template/blob/master/golang_template_github.svg" width="440" height="480" alt="Go Template Logo" />

Also applies to: 5-5, 24-24, 27-27

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 9e3bdf7 and 48e2b81.

Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
Files selected for processing (5)
  • Dockerfile (1 hunks)
  • README.MD (10 hunks)
  • go.mod (2 hunks)
  • scripts/setup-pre-commit.sh (1 hunks)
  • tools.go (1 hunks)
Files skipped from review due to trivial changes (1)
  • go.mod
Additional context used
Hadolint
Dockerfile

[warning] 2-2: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 2-2: Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages (DL3019)


[error] 7-7: Use COPY instead of ADD for files and folders (DL3020)


[error] 8-8: Use COPY instead of ADD for files and folders (DL3020)


[error] 12-12: Use COPY instead of ADD for files and folders (DL3020)


[info] 22-22: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[info] 23-23: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[info] 24-24: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[info] 25-25: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[warning] 28-28: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag (DL3007)


[warning] 29-29: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 30-30: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[warning] 30-30: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)

LanguageTool
README.MD

[style] ~33-~33: Consider a different adverb to strengthen your wording. (ALWAYS_CONSTANTLY)
Context: ...4"> --- We’re always looking for people who value their work...


[style] ~98-~98: Consider shortening or rephrasing this to strengthen your wording. (MAKE_CHANGES)
Context: ... the using docker-compose everytime you make changes to it # Setting up database (postgres) -...


[grammar] ~252-~252: Did you mean “be generated”? (WILL_BASED_ON)
Context: ...kg/api/api.go) ## Schema - Schema can generated or altered manually Take a look at t...


[grammar] ~275-~275: The word ‘container’ is a noun or an adjective. A verb or adverb is missing or misspelled here, or maybe a comma is missing. (PRP_MD_NN)
Context: ... and profiles. Application name should container only lowercase letters. No hyphens and ...

Markdownlint
README.MD

31-31: Expected: ___; Actual: --- (MD035, hr-style)
Horizontal rule style


38-38: Expected: ___; Actual: --- (MD035, hr-style)
Horizontal rule style


69-69: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


77-77: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


84-84: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


131-131: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


137-137: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


143-143: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


149-149: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


217-217: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


225-225: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


236-236: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


277-277: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


285-285: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


302-302: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


317-317: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


323-323: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


331-331: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


339-339: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


345-345: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified


1-1: null (MD045, no-alt-text)
Images should have alternate text (alt text)


5-5: null (MD045, no-alt-text)
Images should have alternate text (alt text)


24-24: null (MD045, no-alt-text)
Images should have alternate text (alt text)


27-27: null (MD045, no-alt-text)
Images should have alternate text (alt text)

Additional comments not posted (3)
tools.go (1)

11-11: Approved the update to sqlboiler import.

The update to use github.com/volatiletech/sqlboiler/v4 aligns with the project's decision to standardize on version 4 of sqlboiler.

scripts/setup-pre-commit.sh (1)

16-16: Approved the addition of go-commitlinter.

Installing go-commitlinter and adding it to the commit message hook enhances commit message quality control, which is beneficial for maintaining project standards.

Dockerfile (1)

4-4: Change RUN mkdir /app to WORKDIR /app.

This is a cleaner and more idiomatic way to set the working directory in a Dockerfile.

Dockerfile Outdated
WORKDIR /app
# copy the go.mod and go.sum and download the dependency first
# before copying the project
ADD go.mod /app
Copy link

@coderabbitai coderabbitai bot Jun 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Replace ADD with COPY for files and folders.

- ADD go.mod /app
- ADD go.sum /app
- ADD . /app
+ COPY go.mod /app
+ COPY go.sum /app
+ COPY . /app

This change aligns with Docker best practices, as COPY is recommended over ADD for files and directories.

Also applies to: 8-8, 11-11

Tools
Hadolint

[error] 7-7: Use COPY instead of ADD for files and folders (DL3020)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai review

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Paras-Wednesday, I've reviewed the changes in the Dockerfile and they align well with Docker best practices. Using COPY instead of ADD for files and folders is recommended unless specific capabilities of ADD are required, such as auto-extracting tar files. The modifications also improve the clarity and efficiency of the Dockerfile by structuring dependency management before adding the project files.

If there are any more specific areas or configurations you would like me to review or if you have any concerns, please let me know!

README.MD Outdated
@@ -29,22 +28,17 @@ An enterprise go template application showcasing - Testing strategies, middlewar
</a>
</div>

___
---
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adjust horizontal rule styles for consistency.

- ---
+ ___

This change ensures consistency with the horizontal rule style used throughout the document.

Also applies to: 38-38

Tools
Markdownlint

31-31: Expected: ___; Actual: --- (MD035, hr-style)
Horizontal rule style

README.MD Outdated
@@ -73,23 +67,23 @@ to configure the following:
3. Install the sqlboiler, sql-migrate and gqlgen using

```
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add language specifications to fenced code blocks.

It's important to specify the language for code blocks to enable proper syntax highlighting and improve readability.

- ```
+ ```bash

Also applies to: 77-77, 84-84, 131-131, 137-137, 143-143, 149-149, 217-217, 225-225, 236-236, 277-277, 285-285, 302-302, 317-317, 323-323, 331-331, 339-339, 345-345

Tools
Markdownlint

69-69: null (MD040, fenced-code-language)
Fenced code blocks should have a language specified

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Outside diff range and nitpick comments (1)
Dockerfile (1)

Line range hint 28-28: Pin the version of the Alpine base image.

Using latest is prone to errors if the image updates. Pinning the version explicitly to a release tag ensures consistency and predictability.

- FROM alpine:latest
+ FROM alpine:3.19
Tools
Hadolint

[warning] 2-2: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 2-2: Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages (DL3019)

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 48e2b81 and e25d130.

Files selected for processing (2)
  • Dockerfile (1 hunks)
  • README.MD (9 hunks)
Additional context used
Hadolint
Dockerfile

[warning] 2-2: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 2-2: Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages (DL3019)


[info] 22-22: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[info] 23-23: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[info] 24-24: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[info] 25-25: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[warning] 28-28: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag (DL3007)


[warning] 29-29: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 30-30: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[warning] 30-30: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)

LanguageTool
README.MD

[style] ~32-~32: Consider a different adverb to strengthen your wording. (ALWAYS_CONSTANTLY)
Context: ..."> --- We’re always looking for people who value their work...


[uncategorized] ~81-~81: Possible missing comma found. (AI_HYDRA_LEO_MISSING_COMMA)
Context: ...boiler-psql@latest For Go 1.18 and above install the sql-migrate using bash ...


[style] ~97-~97: Consider shortening or rephrasing this to strengthen your wording. (MAKE_CHANGES)
Context: ... the using docker-compose everytime you make changes to it # Setting up database (postgres) -...


[grammar] ~251-~251: Did you mean “be generated”? (WILL_BASED_ON)
Context: ...kg/api/api.go) ## Schema - Schema can generated or altered manually Take a look at t...


[grammar] ~274-~274: The word ‘container’ is a noun or an adjective. A verb or adverb is missing or misspelled here, or maybe a comma is missing. (PRP_MD_NN)
Context: ... and profiles. Application name should container only lowercase letters. No hyphens and ...

Markdownlint
README.MD

37-37: Expected: ___; Actual: --- (MD035, hr-style)
Horizontal rule style


1-1: null (MD045, no-alt-text)
Images should have alternate text (alt text)


5-5: null (MD045, no-alt-text)
Images should have alternate text (alt text)


24-24: null (MD045, no-alt-text)
Images should have alternate text (alt text)


27-27: null (MD045, no-alt-text)
Images should have alternate text (alt text)

Additional comments not posted (4)
Dockerfile (2)

7-8: Replace ADD with COPY for files and folders.

As previously noted by the bot and supported by Docker best practices, using COPY for files and directories is recommended over ADD unless the functionality of ADD is required.


Line range hint 29-29: Pin versions in apk add commands.

It's crucial to pin package versions to avoid unexpected changes when newer versions are released. This practice ensures reproducibility and stability of Docker builds.

Also applies to: 30-30

Tools
Hadolint

[warning] 2-2: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 2-2: Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages (DL3019)

README.MD (2)

30-30: Adjust horizontal rule styles for consistency.

Consistent use of horizontal rule styles enhances readability and maintains a uniform appearance throughout the document.


68-71: Ensure the installation instructions are up-to-date.

Given the PR's objective to remove sqlboiler v3 and focus on v4, ensure the installation commands reflect these changes accurately to avoid confusion.

Also applies to: 76-79, 83-85

Verification successful

Ensure the installation instructions are up-to-date.

The installation commands in the README.MD file correctly reference sqlboiler v4. Here are the relevant lines:

  • Line 77: go install github.com/volatiletech/sqlboiler/v4@latest
  • Line 78: go install github.com/volatiletech/sqlboiler/v4/drivers/sqlboiler-psql@latest

These lines confirm that the instructions have been updated to reflect sqlboiler v4.

Scripts executed

The following scripts were executed for the analysis:


Script:

#!/bin/bash
# Description: Verify the correct installation commands for sqlboiler v4.

# Test: Search for sqlboiler installation commands. Expect: Only commands for sqlboiler v4.
rg --type markdown $'go install github.com/volatiletech/sqlboiler/v4@latest'

Length of output: 226



Script:

#!/bin/bash
# Description: Verify the correct installation commands for sqlboiler.

# Test: Search for sqlboiler installation commands in markdown files.
rg --type markdown 'sqlboiler'

Length of output: 179



Script:

#!/bin/bash
# Description: Debug why ripgrep is not searching any files.

# Test: Run ripgrep with debug flag to identify why files are being skipped.
rg --type markdown 'sqlboiler' --debug

Length of output: 25447



Script:

#!/bin/bash
# Description: Verify the correct installation commands for sqlboiler.

# Test: Search for sqlboiler installation commands in markdown files, ignoring any ignore rules.
rg --type markdown 'sqlboiler' --no-ignore

Length of output: 191



Script:

#!/bin/bash
# Description: Verify the correct installation commands for sqlboiler using fd and grep.

# Find all markdown files and search for sqlboiler installation commands.
fd -e md -x grep -Hn 'sqlboiler' {}

Length of output: 512

# before copying the project
COPY go.mod /app
COPY go.sum /app
RUN go mod download
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optimize Docker build layers by merging RUN commands.

The consecutive RUN instructions can be consolidated to reduce the number of layers in the Docker image, which can lead to a smaller image size and potentially faster builds.

- RUN GOARCH=amd64 \
-     GOOS=linux \
-     CGO_ENABLED=0 \
-     go mod vendor
- RUN go run ./cmd/seeder/main.go
- RUN go build -o ./output/server ./cmd/server/main.go
- RUN go build -o ./output/migrations ./cmd/migrations/main.go
- RUN go build -o ./output/seeder ./cmd/seeder/exec/seed.go
+ RUN GOARCH=amd64 GOOS=linux CGO_ENABLED=0 go mod vendor && \
+    go run ./cmd/seeder/main.go && \
+    go build -o ./output/server ./cmd/server/main.go && \
+    go build -o ./output/migrations ./cmd/migrations/main.go && \
+    go build -o ./output/seeder ./cmd/seeder/exec/seed.go

Committable suggestion was skipped due to low confidence.

@Paras-Wednesday
Copy link
Author

@coderabbitai review

Copy link

coderabbitai bot commented Jun 26, 2024

Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between e25d130 and e1a5809.

Files selected for processing (1)
  • Dockerfile (2 hunks)
Additional context used
Hadolint
Dockerfile

[info] 2-2: Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages (DL3019)


[warning] 2-2: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[warning] 28-28: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag (DL3007)


[warning] 29-29: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)


[info] 30-30: Multiple consecutive RUN instructions. Consider consolidation. (DL3059)


[warning] 30-30: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)

Additional comments not posted (3)
Dockerfile (3)

3-3: Good use of WORKDIR to simplify directory handling.

Using WORKDIR instead of mkdir is cleaner and adheres to Docker best practices.


7-8: Optimize dependency management by copying go.mod and go.sum early.

This change effectively uses Docker's caching mechanism to speed up builds. However, consider using COPY instead of ADD for all file copying operations to align with Docker best practices.


22-25: Excellent consolidation of RUN commands to minimize Docker layers.

Consolidating these commands into fewer RUN statements is a great practice to reduce the number of layers, which can lead to smaller Docker image sizes and faster builds.

@@ -1,10 +1,16 @@
FROM golang:1.22-alpine3.19 AS builder
RUN apk add build-base
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Enforce version pinning in apk add commands to enhance security.

Pinning versions of packages in apk add commands is crucial for ensuring the reproducibility and security of Docker builds.

- RUN apk add build-base
- RUN apk add --no-cache libc6-compat 
- RUN apk add --no-cache --upgrade bash
+ RUN apk add build-base=<version>
+ RUN apk add --no-cache libc6-compat=<version> 
+ RUN apk add --no-cache --upgrade bash=<version>

Also applies to: 29-30

Tools
Hadolint

[info] 2-2: Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages (DL3019)


[warning] 2-2: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> (DL3018)

RUN go run ./cmd/seeder/main.go &&\
go build -o ./output/server ./cmd/server/main.go &&\
go build -o ./output/migrations ./cmd/migrations/main.go &&\
go build -o ./output/seeder ./cmd/seeder/exec/seed.go


FROM alpine:latest
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Recommend pinning the Docker image version instead of using latest.

Using latest can lead to unpredictability when the image updates. It's safer to pin the image to a specific version.

- FROM alpine:latest
+ FROM alpine:3.19
Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
FROM alpine:latest
FROM alpine:3.19
Tools
Hadolint

[warning] 28-28: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag (DL3007)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant