You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fineract.apache.org by ad...@apache.org on 2026/01/08 20:31:40 UTC
(fineract) 01/01: FINERACT-2421: Use hardened image
This is an automated email from the ASF dual-hosted git repository.
adamsaghy pushed a commit to branch develop-hardened
in repository https://gitbox.apache.org/repos/asf/fineract.git
commit 47214d3799201419b0c4241d5b84c47672cbb4fc
Author: Adam Saghy <ad...@gmail.com>
AuthorDate: Thu Jan 8 21:26:10 2026 +0100
FINERACT-2421: Use hardened image
---
.github/workflows/build-docker.yml | 9 +++++++++
.github/workflows/build-e2e-tests.yml | 8 ++++++++
.github/workflows/publish-dockerhub.yml | 2 +-
.github/workflows/smoke-messaging.yml | 9 +++++++++
build.gradle | 2 +-
custom/docker/build.gradle | 8 +++++++-
.../apache/fineract/test/factory/LoanProductsRequestFactory.java | 2 +-
fineract-provider/build.gradle | 8 +++++++-
8 files changed, 43 insertions(+), 5 deletions(-)
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index c47e644511..52dc928cff 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -24,6 +24,8 @@ jobs:
env:
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
IMAGE_NAME: fineract
+ DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
+ DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
steps:
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5
@@ -39,6 +41,13 @@ jobs:
- name: Setup Gradle
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+ - name: Login to Docker Hardened Images registry
+ uses: docker/login-action@v3
+ with:
+ registry: dhi.io
+ username: ${{ env.DOCKERHUB_USER }}
+ password: ${{ env.DOCKERHUB_TOKEN }}
+
- name: Build the image
run: ./gradlew --no-daemon --console=plain :fineract-provider:jibDockerBuild -Djib.to.image=$IMAGE_NAME -x test -x cucumber
diff --git a/.github/workflows/build-e2e-tests.yml b/.github/workflows/build-e2e-tests.yml
index 6a3436100d..2a79a3a671 100644
--- a/.github/workflows/build-e2e-tests.yml
+++ b/.github/workflows/build-e2e-tests.yml
@@ -30,6 +30,8 @@ jobs:
EVENT_VERIFICATION_ENABLED: true
ACTIVEMQ_BROKER_URL: tcp://localhost:61616
ACTIVEMQ_TOPIC_NAME: events
+ DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
+ DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
steps:
- name: Checkout code
@@ -56,6 +58,12 @@ jobs:
echo "Shard ${{ matrix.shard_index }} feature files:"
cat feature_shard_${{ matrix.shard_index }}.txt
+ - name: Login to Docker Hardened Images registry
+ uses: docker/login-action@v3
+ with:
+ registry: dhi.io
+ username: ${{ env.DOCKERHUB_USER }}
+ password: ${{ env.DOCKERHUB_TOKEN }}
- name: Build the image
run: ./gradlew --no-daemon --console=plain :fineract-provider:jibDockerBuild -Djib.to.image=$IMAGE_NAME -x test -x cucumber
diff --git a/.github/workflows/publish-dockerhub.yml b/.github/workflows/publish-dockerhub.yml
index e0e94f11c2..2e86d7082f 100644
--- a/.github/workflows/publish-dockerhub.yml
+++ b/.github/workflows/publish-dockerhub.yml
@@ -2,7 +2,7 @@ name: Fineract Publish to DockerHub
on:
push:
branches:
- - develop
+ - develop, develop-hardened
tags:
- 1.*
permissions:
diff --git a/.github/workflows/smoke-messaging.yml b/.github/workflows/smoke-messaging.yml
index 01b7e18f62..9b6c935839 100644
--- a/.github/workflows/smoke-messaging.yml
+++ b/.github/workflows/smoke-messaging.yml
@@ -22,6 +22,8 @@ jobs:
env:
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
IMAGE_NAME: fineract
+ DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
+ DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
steps:
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5
@@ -37,6 +39,13 @@ jobs:
- name: Setup Gradle
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+ - name: Login to Docker Hardened Images registry
+ uses: docker/login-action@v3
+ with:
+ registry: dhi.io
+ username: ${{ env.DOCKERHUB_USER }}
+ password: ${{ env.DOCKERHUB_TOKEN }}
+
- name: Build the image
run: ./gradlew --no-daemon --console=plain :fineract-provider:jibDockerBuild -Djib.to.image=$IMAGE_NAME -x test -x cucumber
diff --git a/build.gradle b/build.gradle
index 17cee30737..28ef9fb6d6 100644
--- a/build.gradle
+++ b/build.gradle
@@ -108,7 +108,7 @@ plugins {
id 'com.gorylenko.gradle-git-properties' version '2.4.2' apply false
id 'org.asciidoctor.jvm.convert' version '4.0.5' apply false
id 'org.asciidoctor.jvm.pdf' version '4.0.5' apply false
- id 'com.google.cloud.tools.jib' version '3.4.5' apply false
+ id 'com.google.cloud.tools.jib' version '3.5.2' apply false
id 'org.sonarqube' version '6.0.1.5171'
id 'com.github.andygoossens.modernizer' version '1.10.0' apply false
id 'com.github.spotbugs' version '6.0.26' apply false
diff --git a/custom/docker/build.gradle b/custom/docker/build.gradle
index 2822fe5376..c12873f5dd 100644
--- a/custom/docker/build.gradle
+++ b/custom/docker/build.gradle
@@ -24,7 +24,13 @@ apply from: "${rootDir}/buildSrc/src/main/groovy/org.apache.fineract.dependencie
jib {
from {
- image = 'azul/zulu-openjdk-alpine:21'
+ def hasDockerCreds =
+ System.getenv("DOCKERHUB_USER")?.trim() &&
+ System.getenv("DOCKERHUB_TOKEN")?.trim()
+
+ image = hasDockerCreds
+ ? "dhi.io/azul:21-jdk-prime"
+ : "azul/zulu-openjdk-alpine:21"
platforms {
platform {
architecture = System.getProperty("os.arch").equals("aarch64")?"arm64":"amd64"
diff --git a/fineract-e2e-tests-core/src/test/java/org/apache/fineract/test/factory/LoanProductsRequestFactory.java b/fineract-e2e-tests-core/src/test/java/org/apache/fineract/test/factory/LoanProductsRequestFactory.java
index f65f458d9a..0e2f3e5218 100644
--- a/fineract-e2e-tests-core/src/test/java/org/apache/fineract/test/factory/LoanProductsRequestFactory.java
+++ b/fineract-e2e-tests-core/src/test/java/org/apache/fineract/test/factory/LoanProductsRequestFactory.java
@@ -1853,7 +1853,7 @@ public class LoanProductsRequestFactory {
.inArrearsTolerance(true)//
.repaymentEvery(true)//
.graceOnPrincipalAndInterestPayment(true)//
- .graceOnArrearsAgeing(true))//
+ .graceOnArrearsAging(true))//
.isEqualAmortization(false)//
.delinquencyBucketId(DELINQUENCY_BUCKET_ID.longValue())//
.enableDownPayment(false)//
diff --git a/fineract-provider/build.gradle b/fineract-provider/build.gradle
index e5751e020a..1e8a69fcd0 100644
--- a/fineract-provider/build.gradle
+++ b/fineract-provider/build.gradle
@@ -243,7 +243,13 @@ bootJar {
jib {
from {
- image = 'azul/zulu-openjdk-alpine:21'
+ def hasDockerCreds =
+ System.getenv("DOCKERHUB_USER")?.trim() &&
+ System.getenv("DOCKERHUB_TOKEN")?.trim()
+
+ image = hasDockerCreds
+ ? "dhi.io/azul:21-jdk-prime"
+ : "azul/zulu-openjdk-alpine:21"
platforms {
platform {
architecture = System.getProperty("os.arch").equals("aarch64")?"arm64":"amd64"