CodeSnips

bash

#!/usr/bin/env bash
set -euo pipefail

bundle exec bundler-audit check --update
npm audit --audit-level=high
pip-audit --strict

Dependency vulnerability scanning for Ruby and Node projects

dependency-scanning supply-chain ruby

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
set -euo pipefail

cosign sign --key env://COSIGN_PRIVATE_KEY ghcr.io/example/codesnips:${GITHUB_SHA}
cosign verify --key env://COSIGN_PUBLIC_KEY ghcr.io/example/codesnips:${GITHUB_SHA}

Signed release artifacts with cosign for software supply chain trust

supply-chain cosign signing

by Kai Nakamura 1 tab

dockerfile

FROM ruby:3.3.1-slim AS base

RUN apt-get update \
  && apt-get install -y --no-install-recommends build-essential libpq-dev \
  && rm -rf /var/lib/apt/lists/*

Dockerfile hardening for smaller safer containers

docker containers hardening

by Kai Nakamura 1 tab