appotry · pull · Feb 25, 2025 · Feb 25, 2025 · Feb 25, 2025 · Feb 26, 2025
diff --git a/.github/workflows/mend.yaml b/.github/workflows/mend.yaml
@@ -0,0 +1,55 @@
+name: Mend CLI Scan
+
+on:
+  workflow_dispatch:
+  # pull_request:
+  #   branches: [master]
+  # push:
+  #   branches: [master]
+
+jobs:
+  mend:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        image:
+          - 'docker.io/vespaengine/vespa:8'
+          - 'docker.io/vespaengine/vespa-build-almalinux-8:latest'
+          - 'docker.io/vespaengine/vespa-dev-almalinux-8:latest'
+          - 'docker.io/vespaengine/vespa-build-almalinux-9:latest'
+          - 'docker.io/vespaengine/vespa-dev-almalinux-9:latest'
+
+    steps:
+    - name: Free disk space
+      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
+      with:
+        large-packages: false
+        docker-images: false
+        swap-storage: false
+
+    - name: Downloading Mend CLI
+      run: |
+        echo Downloading Mend CLI
+        curl https://downloads.mend.io/cli/linux_amd64/mend -o /usr/local/bin/mend && chmod +x /usr/local/bin/mend
+
+    - name: Mend CLI Scan
+      env:
+        MEND_EMAIL: ${{secrets.MEND_EMAIL}}
+        MEND_USER_KEY: ${{secrets.MEND_USER_KEY}}
+        MEND_URL: https://saas-eu.mend.io
+        IMAGE: ${{ matrix.image }}
+      run: |
+        echo "Scanning image ${IMAGE}"
+
+        # Project is everything after the last slash, excluding the tag
+        MEND_PROJECT=${IMAGE##*/}
+        MEND_PROJECT=${MEND_PROJECT%:*}
+        echo "Project: ${MEND_PROJECT}"
+
+        # Application is everything before the last slash (typically: docker.io/vespaengine)
+        MEND_APPLICATION=${IMAGE%/*}
+        echo "Application: ${MEND_APPLICATION}"
+
+        mend image "${IMAGE}" --force-reachability --scope "Vespa.ai//${MEND_APPLICATION}//${MEND_PROJECT}"
diff --git a/Dockerfile b/Dockerfile
@@ -16,20 +16,6 @@ RUN echo "install_weak_deps=False" >> /etc/dnf/dnf.conf && \
 
 LABEL org.opencontainers.image.base.name="docker.io/almalinux:8"
 
-FROM quay.io/centos/centos:stream8 as stream8
-
-RUN echo "install_weak_deps=False" >> /etc/dnf/dnf.conf && \
-    dnf -y install \
-      dnf-plugins-core \
-      epel-release && \
-    dnf config-manager --add-repo https://copr.fedorainfracloud.org/coprs/g/vespa/vespa/repo/epel-8/group_vespa-vespa-epel-8.repo && \
-    dnf config-manager --enable powertools && \
-    dnf remove -y dnf-plugins-core && \
-    dnf clean all && \
-    rm -rf /var/cache/dnf
-
-LABEL org.opencontainers.image.base.name="quay.io/centos/centos:stream8"
-
 FROM docker.io/almalinux:9 as el9
 
 RUN echo "install_weak_deps=False" >> /etc/dnf/dnf.conf && \

diff --git a/include/start-container.sh b/include/start-container.sh
@@ -15,6 +15,11 @@ cleanup() {
     exit $?
 }
 
+verify_container_env() {
+    /opt/vespa/bin/verify-container-env
+    [ $? -eq 0 ] || exit 1
+}
+
 if [ -n "$1" ]; then
     if [ -z "$VESPA_CONFIGSERVERS" ]; then
         echo "VESPA_CONFIGSERVERS must be set with '-e VESPA_CONFIGSERVERS=<comma separated list of config servers>' argument to docker."
@@ -37,6 +42,7 @@ if [ -n "$1" ]; then
                 /opt/vespa/bin/vespa-stop-services
                 exit $?
             }
+            verify_container_env
             /opt/vespa/bin/vespa-start-configserver
             /opt/vespa/bin/vespa-start-services
             ;;
@@ -49,6 +55,9 @@ else
     if [ -z "$VESPA_CONFIGSERVERS" ]; then
         export VESPA_CONFIGSERVERS=$(hostname)
     fi
+
+    verify_container_env
+
     /opt/vespa/bin/vespa-start-configserver
     /opt/vespa/bin/vespa-start-services
 fi