[Mouette03]

This pull request introduces significant improvements to the Docker build process and CI security scanning for the project. The main focus is on enhancing security by removing unnecessary build tools from the final image, improving build reproducibility, and adding automated vulnerability scanning in CI.

Docker image hardening and reproducibility:

• The Dockerfiles (dockerfile and dockerfile.template) now pin the version of mlocati/php-extension-installer instead of using latest, ensuring reproducible builds. [1] [2]
• After installing PHP extensions, a new step removes all compilation tools and related dependencies from the image, reducing the attack surface and the number of potential CVEs. The process includes checks to ensure no runtime libraries are missing and that no compilers remain. [1] [2]
• A validation step is added to verify that the Apache configuration remains valid after cleanup. [1] [2]

Continuous Integration security improvements:

• A new GitHub Actions workflow .github/workflows/security-scan.yml is introduced, which builds the Docker image locally (without publishing) and scans it for vulnerabilities using Trivy. The workflow blocks merges if fixable CRITICAL CVEs are found and publishes a summary report in the job output. The Trivy action is pinned by commit SHA for security.

Summary by CodeRabbit

• Sécurité
  • Ajout d’un contrôle automatisé des vulnérabilités de l’image, avec rapport des failles détectées et échec du contrôle en cas de vulnérabilité critique corrigible.
• Fiabilité
  • Vérification de la configuration Apache et des extensions PHP lors de la création de l’image.
  • Suppression des outils de compilation après l’installation des extensions afin de limiter leur présence dans l’image finale.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b28b0665-dc4c-4f50-96dc-f63f83fcf6cd

📥 Commits

Reviewing files that changed from the base of the PR and between 5b90723 and 7478bf1.

📒 Files selected for processing (3)

• .github/workflows/security-scan.yml
• dockerfile
• dockerfile.template

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Les Dockerfiles épinglent l’installateur PHP, suppriment les outils de compilation et ajoutent des contrôles de bibliothèques, de modules PHP et de configuration Apache. Un workflow construit l’image localement, publie un rapport Trivy et échoue si une vulnérabilité critique corrigible subsiste.

Changes

Durcissement et analyse de l’image

Layer / File(s)	Summary
Nettoyage et contrôles des Dockerfiles dockerfile, dockerfile.template	Les deux fichiers épinglent install-php-extensions à la version 2.12.0. Ils purgent les outils de compilation et vérifient les bibliothèques requises, les modules PHP et l’absence des outils ciblés. Ils contrôlent aussi la configuration Apache avec apache2ctl -t.
Déclenchement et construction de l’image .github/workflows/security-scan.yml	Le workflow s’exécute sur les pull requests, les push vers security/** et les lancements manuels. Il construit localement webapp:scan pour linux/amd64, sans publication.
Rapport et contrôle des vulnérabilités .github/workflows/security-scan.yml	Trivy produit un rapport de vulnérabilités OS et de bibliothèques corrigibles, toutes sévérités confondues. Le workflow ajoute le rapport au résumé du job et échoue si l’analyse détecte une vulnérabilité critique corrigible.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant Buildx
  participant Trivy
  participant JobSummary
  GitHubActions->>Buildx: Construit l'image webapp:scan
  Buildx->>Trivy: Transmet l'image locale à analyser
  Trivy->>GitHubActions: Produit le rapport et le résultat du contrôle critique
  GitHubActions->>JobSummary: Ajoute le rapport au résumé du job

Loading

Merge Risk: ⚪ Minimal · up to 7478b

The scan builds the intended hardened image, and no actionable merge risk was identified. Normal build and CI checks remain appropriate.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Le titre « Security/reduce cves » décrit directement l’objectif principal du changement : réduire les CVE dans l’image Docker et le contrôle de sécurité CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Un lapin suit l’image au jardin,
Trivy y cherche les failles du matin.
Les outils de build quittent le terrier,
Apache passe son contrôle sans broncher.
Le rapport rejoint le résumé,
Et le lapin repart satisfait.}

_{Comment @coderabbitai help to get the list of available commands.}