fix: Security vulnerabilities addressed, Phonito fails build only on …

…high or higher severity (#28)

.github/workflows/ci.yml

@@ -36,4 +36,5 @@ jobs:
         uses: phonito/phonito-scanner-action@master
         with:
           image: ${{ env.IMAGE_NAME }}:${{ steps.vars.outputs.docker_tag }}
-          phonito-token: '${{ secrets.PHONITO_TOKEN }}'      
+          fail-level: 'HIGH'
+          phonito-token: '${{ secrets.PHONITO_TOKEN }}'

.github/workflows/ci_cd.yml

@@ -48,6 +48,7 @@ jobs:
         with:
           image: ${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}
           phonito-token: '${{ secrets.PHONITO_TOKEN }}'
+          fail-level: 'HIGH'
 
       - name: "Tag image as latest"
         if: env.RELEASE_VERSION != ''

.github/workflows/regular_scan.yml

@@ -17,4 +17,5 @@ jobs:
         uses: phonito/phonito-scanner-action@master
         with:
           image: ${{ env.IMAGE_NAME }}:latest
-          phonito-token: '${{ secrets.PHONITO_TOKEN }}'
+          phonito-token: '${{ secrets.PHONITO_TOKEN }}'
+          fail-level: 'HIGH'

Dockerfile

@@ -1,6 +1,6 @@
 FROM squidfunk/mkdocs-material:5.3.3 as material
 
-FROM ubuntu:bionic
+FROM ubuntu:bionic-20200713
 
 LABEL maintainer="Lukas Holota <[email protected]>"
 LABEL io.homecentr.dependency-version=5.1.1
@@ -14,15 +14,17 @@ ADD https://github.com/jgraph/drawio-desktop/releases/download/v12.9.13/draw.io-
 COPY --from=material /usr/local/bin/mkdocs /usr/local/bin/mkdocs
 
     # Install the downloaded package and dependencies required for headless execution
-    # hadolint ignore=DL3015,DL3008
+    # hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install --no-install-recommends /tmp/drawio.deb -y && \
-    apt-get install -y \
-        libasound2 \
-        xvfb \
-        python3-pip \
-        git && \
-    # Clean up apt cache
+    apt-get install -y --no-install-recommends \
+        libasound2=1.1.3-5ubuntu0.5 \
+        xvfb=2:1.19.6-1ubuntu4.4 \
+        python3-pip=9.0.1-2.3~ubuntu1.18.04.1 \
+        python3=3.6.7-1~18.04 \
+        git=1:2.17.1-1ubuntu0.7 \
+        # Required by draw.io
+        glib-networking=2.56.0-1ubuntu0.1 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
@@ -32,7 +34,8 @@ RUN git clone https://github.com/squidfunk/mkdocs-material
 
 WORKDIR /tmp/mkdocs-material
 
-RUN pip3 install --no-cache-dir . && \
+RUN pip3 install --no-cache-dir setuptools==49.2.0 && \
+    pip3 install --no-cache-dir . && \
     pip3 install --no-cache-dir \
                 mkdocs-drawio-exporter==0.6.1 \
                 mkdocs-minify-plugin==0.3.0 \
@@ -42,7 +45,15 @@ RUN pip3 install --no-cache-dir . && \
 
 COPY ./entrypoint.sh /entrypoint.sh
 
-RUN rm -rf /tmp/** && chmod a+x /entrypoint.sh
+# rm -rf /tmp/** &&
+RUN chmod a+x /entrypoint.sh
+
+RUN apt-get remove --purge -y binutils git perl patch openssl bzip2 procps && \
+    #glib-networking 
+    apt-get autoremove -y && \
+    # Clean up apt cache
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /docs