Building OCI Image with Nix

.github/workflows/devguard-web.yaml

@@ -0,0 +1,46 @@
+# DevSecOps Workflow Definition
+# This workflow is triggered on every push to the repository
+name: DevGuard-Web-Workflow
+
+on:
+  workflow_dispatch:
+  push:
+
+jobs:
+  code-scanning:
+    uses: l3montree-dev/devguard-action/.github/workflows/code-scanning.yml@nix
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-web
+      api-url: https://api.main.devguard.org
+      fail-on-risk: high
+      fail-on-cvss: high
+      web-ui: https://main.devguard.org
+      continue-on-open-code-risk: true
+    secrets:
+      devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
+
+  web-pipeline:
+    uses: l3montree-dev/devguard-action/.github/workflows/full-nix.yml@nix
+    permissions:
+      contents: read
+      packages: write
+      security-events: write
+    with:
+      nix-target-amd64: devguard-web-amd64
+      nix-target-arm64: devguard-web-arm64
+      nix-version: '2.34.4'
+      image-name: ghcr.io/${{ github.repository }}
+      asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-web
+      api-url: https://api.main.devguard.org
+      web-ui: https://main.devguard.org
+      fail-on-cvss: high
+      fail-on-risk: high
+      nix-cache-substituter: https://nix.garage.l3montree.cloud
+      nix-cache-public-key: nix.garage.l3montree.cloud:MGlzfPQKA91/zxw91CN+GP7NpjAAwmKvWXlDYgeeI8k=
+      nix-cache-s3-bucket: nix
+      nix-cache-region: garage
+    secrets:
+      devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

.github/workflows/mirror-to-gitlab.yml

@@ -0,0 +1,29 @@
+name: Mirror to GitLab
+
+on:
+  push:
+    branches: ["**"]
+    tags: ["**"]
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - https://github.com/actions/checkout/releases/tag/v5.0.0
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+
+      - name: Mirror to GitLab
+        continue-on-error: true
+        run: |
+          git remote add gitlab "https://oauth2:${GITLAB_TOKEN}@${GITLAB_HOST}/${GITLAB_REPO}.git"
+          git push --prune gitlab 'refs/heads/*:refs/heads/*'
+          git push --prune gitlab 'refs/tags/*:refs/tags/*'
+        env:
+          GITLAB_TOKEN: ${{ secrets.GITLAB_MIRROR_TOKEN }}
+          GITLAB_HOST: ${{ vars.GITLAB_HOST }}
+          GITLAB_REPO: ${{ vars.GITLAB_REPO }}

.gitignore

@@ -40,3 +40,6 @@ next-env.d.ts
 image.tar
 # Sentry Config File
 .env.sentry-build-plugin
+
+# nix
+result

.gitlab-ci.yml

@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: AGPL-3.0
+# GitLab CI for the devguard-web repository (mirrored from GitHub).
+
+stages:
+  - .pre
+  - build
+  - oci-image
+  - attestation
+
+
+.common: &common
+  devguard_asset_name: "$DEVGUARD_ASSET_NAME"
+  devguard_api_url: "$DEVGUARD_API_URL"
+  devguard_web_ui: "$DEVGUARD_WEB_UI"
+  devguard_token: "$DEVGUARD_TOKEN"
+  nix_cache_substituter: https://nix.garage.l3montree.cloud
+  nix_cache_public_key: nix.garage.l3montree.cloud:MGlzfPQKA91/zxw91CN+GP7NpjAAwmKvWXlDYgeeI8k=
+  nix_cache_s3_bucket: nix
+  nix_cache_region: garage
+  version: nix
+
+
+include:
+  - remote: https://gitlab.com/l3montree/devguard/-/raw/nix/templates/build-nix-multiarch.yml
+    inputs:
+      <<: *common
+      nix_target_amd64: "devguard-web-amd64"
+      nix_target_arm64: "devguard-web-arm64"
+      arm64_runner_tag: "arm"

Makefile

@@ -0,0 +1,12 @@
+NIX_CACHE_BUCKET     ?= nix.garage.l3montree.cloud
+NIX_CACHE_ENDPOINT   ?= s3.garage.l3montree.cloud
+NIX_CACHE_REGION     ?= garage
+NIX_CACHE_SECRET_KEY ?= /etc/nix/cache-priv-key.pem
+
+nix-cache-push::
+	@echo "Building node_modules..."
+	nix build --no-link .#node_modules
+	@echo "Pushing closure to S3 cache..."
+	nix copy \
+		$$(nix path-info -r .#node_modules) \
+		--to 's3://$(NIX_CACHE_BUCKET)?endpoint=$(NIX_CACHE_ENDPOINT)&region=$(NIX_CACHE_REGION)&scheme=https&profile=garage&secret-key=$(NIX_CACHE_SECRET_KEY)'

e2e/src/pom/devguard.ts

@@ -1,4 +1,5 @@
-import { expect, Page } from "@playwright/test";
+import { expect } from "@playwright/test";
+import type { Page } from "@playwright/test";
 import { envConfig, LoggingAnalyzer } from "../utils";
 
 export enum DevGuardNavigationLevel {

e2e/src/pom/opencode.ts

@@ -1,4 +1,5 @@
-import { expect, Locator, Page } from "@playwright/test";
+import { expect } from "@playwright/test";
+import type { Locator, Page } from "@playwright/test";
 import { envConfig, generateOTP } from "../utils";
 
 export class OpenCodePOM {

e2e/src/utils.ts

@@ -1,6 +1,6 @@
 import * as OTPAuth from "otpauth";
 import { DevGuardPOM } from "./pom/devguard";
-import { Page } from "@playwright/test";
+import type { Page } from "@playwright/test";
 import { OpenCodePOM } from "./pom/opencode";
 import path from "path";
 import dotenv from "dotenv";