Skip to content

Commit 79f8d03

Browse files
ggguardianggguardian
committed
init
1 parent 955d13e commit 79f8d03

36 files changed

+2319
-1
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
name: CI
2+
3+
on:
4+
# pull_request:
5+
push:
6+
branches:
7+
- 'init'
8+
tags-ignore:
9+
- '*'
10+
paths-ignore:
11+
- 'demo/**'
12+
- 'docs/**'
13+
- 'LICENSE'
14+
- 'README.md'
15+
workflow_dispatch:
16+
17+
env:
18+
DAGGER_VERSION: "0.13.7"
19+
DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
20+
DOCKER_REPOSITORY: ${{ vars.DOCKER_REPOSITORY }}
21+
DOCKER_REGISTRY_USERNAME: ${{ vars.DOCKER_REGISTRY_USERNAME }}
22+
DOCKER_REGISTRY_PASSWORD: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
23+
GH_DOCKER_REPOSITORY: ${{ vars.GH_DOCKER_REPOSITORY }}
24+
GH_HELM_REPOSITORY: ${{ vars.GH_HELM_REPOSITORY }}
25+
26+
jobs:
27+
docker:
28+
runs-on: ubuntu-latest
29+
30+
strategy:
31+
matrix:
32+
target: ["debug", "prod"]
33+
34+
permissions:
35+
contents: read
36+
packages: write
37+
attestations: write
38+
id-token: write
39+
40+
steps:
41+
- name: Checkout
42+
uses: actions/checkout@v4
43+
44+
- name: Set short SHA
45+
id: sha
46+
run: echo "short_sha=${GITHUB_SHA::7}" >> $GITHUB_ENV
47+
48+
- name: Set image tag
49+
id: tag
50+
run: |
51+
if [ "${{ github.ref }}" == "refs/heads/init" ]; then
52+
if [[ "${{ matrix.target }}" == "debug" ]]; then
53+
echo "tag=unstable-debug" >> $GITHUB_ENV
54+
else
55+
echo "tag=unstable" >> $GITHUB_ENV
56+
fi
57+
else
58+
if [[ "${{ matrix.target }}" == "debug" ]]; then
59+
echo "tag=build-${{ env.short_sha }}-debug" >> $GITHUB_ENV
60+
else
61+
echo "tag=build-${{ env.short_sha }}" >> $GITHUB_ENV
62+
fi
63+
fi
64+
65+
- name: Publish Docker image
66+
uses: dagger/dagger-for-github@v6
67+
env:
68+
GH_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
69+
with:
70+
version: ${{ env.DAGGER_VERSION }}
71+
engine-stop: false
72+
module: github.com/opopops/daggerverse/[email protected]
73+
verb: call
74+
args: |
75+
--registry=${DOCKER_REGISTRY} \
76+
--username=${DOCKER_REGISTRY_USERNAME} \
77+
--password=env:DOCKER_REGISTRY_PASSWORD \
78+
build \
79+
--context=. \
80+
--target=${{ matrix.target }} \
81+
--platform=linux/amd64,linux/arm64 \
82+
publish \
83+
--image=${DOCKER_REGISTRY}/${DOCKER_REPOSITORY}:${{ env.tag }} \
84+
85+
86+
- name: Scan Docker image
87+
uses: dagger/dagger-for-github@v6
88+
env:
89+
GH_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
90+
with:
91+
version: ${{ env.DAGGER_VERSION }}
92+
module: github.com/opopops/daggerverse/[email protected]
93+
verb: call
94+
args: |
95+
with-registry-auth \
96+
--address=ghcr.io \
97+
--username=${{ github.actor }} \
98+
--secret=env:GH_REGISTRY_PASSWORD \
99+
scan \
100+
--source=ghcr.io/${GH_DOCKER_REPOSITORY}:${{ env.tag }} \
101+
102+
helm:
103+
runs-on: ubuntu-latest
104+
105+
permissions:
106+
contents: read
107+
packages: write
108+
attestations: write
109+
id-token: write
110+
111+
steps:
112+
- name: Checkout
113+
uses: actions/checkout@v4
114+
115+
- name: Lint
116+
uses: dagger/dagger-for-github@v6
117+
with:
118+
version: ${{ env.DAGGER_VERSION }}
119+
engine-stop: false
120+
module: github.com/purpleclay/daggerverse/[email protected]
121+
verb: call
122+
args: |
123+
lint \
124+
--dir chart \
125+
--strict \
126+
127+
- name: Publish Helm chart
128+
uses: dagger/dagger-for-github@v6
129+
env:
130+
GH_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
131+
with:
132+
version: ${{ env.DAGGER_VERSION }}
133+
engine-stop: false
134+
module: github.com/purpleclay/daggerverse/[email protected]
135+
verb: call
136+
args: |
137+
package-push \
138+
--dir chart \
139+
--version="0.0.0" \
140+
--appVersion="1.0.0" \
141+
--registry=ghcr.io/${GH_HELM_REPOSITORY} \
142+
--username=${{ github.actor }} \
143+
--password=env:GH_REGISTRY_PASSWORD \

‎.github/workflows/release.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
8+
env:
9+
DAGGER_VERSION: "0.13.7"
10+
DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
11+
DOCKER_REPOSITORY: ${{ vars.DOCKER_REPOSITORY }}
12+
DOCKER_REGISTRY_USERNAME: ${{ vars.DOCKER_REGISTRY_USERNAME }}
13+
DOCKER_REGISTRY_PASSWORD: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
14+
15+
jobs:
16+
docker:
17+
if: startsWith(github.event.ref, 'refs/tags/v')
18+
19+
name: Release Docker image
20+
runs-on: ubuntu-latest
21+
22+
strategy:
23+
matrix:
24+
target: ["debug", "prod"]
25+
26+
permissions:
27+
contents: read
28+
packages: write
29+
attestations: write
30+
id-token: write
31+
32+
steps:
33+
- name: Checkout
34+
uses: actions/checkout@v4
35+
36+
- name: Publish Docker image
37+
uses: dagger/dagger-for-github@v6
38+
env:
39+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
40+
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
41+
with:
42+
version: ${{ env.DAGGER_VERSION }}
43+
cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}
44+
engine-stop: false
45+
module: github.com/opopops/daggerverse/[email protected]
46+
verb: call
47+
args: |
48+
--registry=${DOCKER_REGISTRY} \
49+
--username=${DOCKER_REGISTRY_USERNAME} \
50+
--password=env:DOCKER_REGISTRY_PASSWORD \
51+
build \
52+
--context=. \
53+
--target=${{ matrix.target }} \
54+
--platform=linux/amd64,linux/arm64 \
55+
publish \
56+
--image=${DOCKER_REGISTRY}/${DOCKER_REPOSITORY}:${{ github.ref_name }} \
57+
sign \
58+
--password=env:COSIGN_PASSWORD \
59+
--private-key=env:COSIGN_PRIVATE_KEY \
60+
61+
- name: Scan Docker image
62+
uses: dagger/dagger-for-github@v6
63+
with:
64+
version: ${{ env.DAGGER_VERSION }}
65+
cloud-token: ${{ secrets.DAGGER_CLOUD_TOKEN }}
66+
module: github.com/opopops/daggerverse/[email protected]
67+
verb: call
68+
args: |
69+
with-registry-auth \
70+
--address=${DOCKER_REGISTRY} \
71+
--username=${DOCKER_REGISTRY_USERNAME} \
72+
--secret=env:DOCKER_REGISTRY_PASSWORD \
73+
scan \
74+
--source=${DOCKER_REGISTRY}/${DOCKER_REPOSITORY}:${{ github.ref_name }} \
75+
--fail-on=high \

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.local/

‎Dockerfile‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# syntax=docker/dockerfile:1
2+
3+
ARG REGISTRY="cgr.dev"
4+
5+
### Base
6+
FROM --platform=$BUILDPLATFORM ${REGISTRY}/chainguard/wolfi-base:latest AS base
7+
8+
LABEL org.opencontainers.image.authors="GitGuardian SRE Team <[email protected]>"
9+
10+
ARG TARGETOS
11+
ARG TARGETARCH
12+
ARG TARGETVARIANT
13+
14+
RUN apk add --no-cache \
15+
curl
16+
17+
### WSTunnel
18+
FROM base AS wstunnel
19+
20+
ARG WSTUNNEL_VERSION="10.1.5"
21+
ENV WSTUNNEL_VERSION=$WSTUNNEL_VERSION
22+
RUN curl -fsSL https://github.com/erebe/wstunnel/releases/download/v${WSTUNNEL_VERSION}/wstunnel_${WSTUNNEL_VERSION}_${TARGETOS}_${TARGETARCH}.tar.gz | \
23+
tar xvzf - -C /usr/bin wstunnel && \
24+
chmod 755 /usr/bin/wstunnel
25+
USER 65532
26+
27+
FROM base AS builder
28+
29+
RUN apk add --no-cache \
30+
bash \
31+
git \
32+
go
33+
34+
35+
### Build
36+
FROM builder AS build
37+
38+
WORKDIR /build
39+
COPY go.mod .
40+
COPY main.go .
41+
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
42+
go build -o ggbridge -ldflags "-w" .
43+
44+
45+
### Dev
46+
FROM builder AS dev
47+
48+
RUN apk add --no-cache \
49+
nano \
50+
openssl \
51+
vim
52+
53+
COPY --link --from=wstunnel --chmod=755 /usr/bin/wstunnel /usr/bin/wstunnel
54+
55+
56+
### Debug
57+
FROM base AS debug
58+
59+
LABEL org.opencontainers.image.description="ggbridge - connect your on-prem VCS with the GitGuardian Platform"
60+
61+
RUN apk add --no-cache \
62+
bash \
63+
curl \
64+
nginx-mainline \
65+
openssl
66+
67+
RUN install -d -m 755 -o 65532 -g 65532 \
68+
/var/lib/nginx \
69+
/var/lib/nginx/html \
70+
/var/lib/nginx/logs && \
71+
install -d -m 777 -o 65532 -g 65532 \
72+
/var/lib/nginx/tmp \
73+
/var/run
74+
75+
COPY --link --from=wstunnel --chmod=755 /usr/bin/wstunnel /usr/bin/wstunnel
76+
COPY --link --from=build --chmod=755 /build/ggbridge /usr/bin/ggbridge
77+
78+
USER 65532
79+
80+
ENTRYPOINT []
81+
CMD ["/bin/sh", "-l"]
82+
83+
84+
### Prod
85+
FROM ${REGISTRY}/chainguard/glibc-dynamic:latest AS prod
86+
87+
LABEL org.opencontainers.image.authors="GitGuardian SRE Team <[email protected]>"
88+
LABEL org.opencontainers.image.description="ggbridge - connect your on-prem VCS with the GitGuardian Platform"
89+
90+
COPY --link --from=wstunnel --chmod=755 /usr/bin/wstunnel /usr/bin/wstunnel
91+
COPY --link --from=build --chmod=755 /build/ggbridge /usr/bin/ggbridge
92+
93+
ENTRYPOINT ["/usr/bin/ggbridge"]
94+
CMD ["client"]

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024 Germain
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,18 @@
1-
# ggbridge
1+
# ggbridge: connect your on-prem VCS with the GitGuardian Platform
2+
3+
**ggbridge** is a tool designed to facilitate secure connections between the GitGuardian SaaS platform and your on-premise Version Control Systems (VCS) that are not exposed to the public internet. By acting as a secure bridge, GGBridge enables GitGuardian to access repositories located in isolated environments, ensuring that your sensitive code data remains protected while taking advantage of GitGuardian’s powerful scanning capabilities.
4+
5+
With ggbirdge, organizations can maintain their internal infrastructure and security protocols without sacrificing the ability to integrate with GitGuardian’s monitoring and alerting features.
6+
7+
## How it Works
8+
9+
![ggbridge](./docs/assets/ggbridge.drawio.png)
10+
11+
**ggbridge** is composed of two main parts:
12+
13+
- **Server**: Installed on the GitGuardian's network.
14+
- **Client**: Installed on the customer’s private network.
15+
16+
The client component connects to the server using the WebSocket protocol to establish a secure, mutually authenticated (mTLS) tunnel between the customer’s network and the GitGuardian SaaS platform. This ensures both ends are securely authenticated.
17+
18+
Once the tunnel is established, a proxy server is deployed on the GitGuardian side, which allows secure access to the client’s on-prem VCS through the tunnel. This proxy connection enables GitGuardian to scan and monitor your repositories without requiring your VCS to be publicly accessible.

‎chart/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
values-local*.yaml
2+
values-local*.yml

‎chart/.helmignore‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/
24+
25+
values-local.yaml
26+
values-local.yml

‎chart/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: ggbridge
3+
description: A Helm chart for installing ggbridge
4+
type: application
5+
version: 0.0.0
6+
appVersion: "1.0.0"

0 commit comments

Comments
 (0)