chore: automatically bundle latest collector versions in docker image BED-7545#2732
Open
lrfalslev wants to merge 15 commits into
Open
chore: automatically bundle latest collector versions in docker image BED-7545#2732lrfalslev wants to merge 15 commits into
lrfalslev wants to merge 15 commits into
Conversation
Contributor
📝 WalkthroughWalkthroughThis PR introduces dynamic resolution of SharpHound and AzureHound collector versions from GitHub releases, replacing hardcoded defaults. Changes flow through a new GitHub action for CI, Just task helpers for local development, Docker Compose configuration, and updated Dockerfiles that validate versions and download artifacts with checksum verification. ChangesDynamic Collector Version Resolution
🎯 4 (Complex) | ⏱️ ~60 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
lrfalslev
added
the
infrastructure
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/resolve-collector-versions/action.yml:
- Around line 36-46: Enable strict shell mode and validate the tag outputs
before writing to GITHUB_OUTPUT: add set -euo pipefail and IFS= to the script,
run the gh api calls in a way that detects failures (e.g., capture output and
check the exit status of the gh command that produces sharphound_version and
azurehound_version), then assert each resolved value is non-empty and not the
literal "null" and matches the expected semver tag regex (e.g.,
^v[0-9]+\.[0-9]+\.[0-9]+$) before echoing "sharphound_version=…" /
"azurehound_version=…" to GITHUB_OUTPUT; if validation fails, emit a clear error
via echo "::error::" and exit non-zero so the action fails fast.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: b94f357b-e6d7-40ed-ab01-68631088f301
📒 Files selected for processing (7)
.github/actions/resolve-collector-versions/action.yml.github/workflows/cd.ymldocker-compose.dev.ymldockerfiles/bloodhound.Dockerfilejustfiletools/docker-compose/api.Dockerfiletools/docker-compose/neo4j.Dockerfile
Comment on lines
+36
to
+46
| run: | | ||
| sharphound_version="$(gh api repos/SpecterOps/SharpHound/releases/latest --jq .tag_name)" | ||
| azurehound_version="$(gh api repos/SpecterOps/AzureHound/releases/latest --jq .tag_name)" | ||
|
|
||
| # Output versions | ||
| echo "sharphound_version=${sharphound_version}" >> "${GITHUB_OUTPUT}" | ||
| echo "azurehound_version=${azurehound_version}" >> "${GITHUB_OUTPUT}" | ||
|
|
||
| # Log for visibility | ||
| echo "::notice::Using SharpHound ${sharphound_version}" | ||
| echo "::notice::Using AzureHound ${azurehound_version}" |
Contributor
There was a problem hiding this comment.
Harden the resolver against silent gh api failures.
The shell block has no strict mode and never validates the resolved tags before writing them to GITHUB_OUTPUT. Two realistic failure modes leak through:
gh apinon-zero exit:var=$(gh api …)does not propagate the failure toset -e(assignment masks the substitution exit), so the script proceeds with an empty value.- Missing
tag_name:--jq .tag_nameemits the literal stringnull, which then becomes the build arg.
In both cases the only signal is a downstream Dockerfile validation error ("must match vX.Y.Z"), which is far from the root cause. Fail fast inside the action instead.
🛡️ Proposed fix to add strict mode and format validation
- id: fetch-collector-versions
name: Fetch Collector Versions
shell: bash
run: |
+ set -euo pipefail
sharphound_version="$(gh api repos/SpecterOps/SharpHound/releases/latest --jq .tag_name)"
azurehound_version="$(gh api repos/SpecterOps/AzureHound/releases/latest --jq .tag_name)"
+ # Validate versions before emitting them so failures surface here, not in the downstream build.
+ version_regex='^v[0-9]+\.[0-9]+\.[0-9]+$'
+ if [[ ! "${sharphound_version}" =~ ${version_regex} ]]; then
+ echo "::error::Invalid SharpHound version resolved: '${sharphound_version:-<empty>}'"
+ exit 1
+ fi
+ if [[ ! "${azurehound_version}" =~ ${version_regex} ]]; then
+ echo "::error::Invalid AzureHound version resolved: '${azurehound_version:-<empty>}'"
+ exit 1
+ fi
+
# Output versions
echo "sharphound_version=${sharphound_version}" >> "${GITHUB_OUTPUT}"
echo "azurehound_version=${azurehound_version}" >> "${GITHUB_OUTPUT}"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/actions/resolve-collector-versions/action.yml around lines 36 - 46,
Enable strict shell mode and validate the tag outputs before writing to
GITHUB_OUTPUT: add set -euo pipefail and IFS= to the script, run the gh api
calls in a way that detects failures (e.g., capture output and check the exit
status of the gh command that produces sharphound_version and
azurehound_version), then assert each resolved value is non-empty and not the
literal "null" and matches the expected semver tag regex (e.g.,
^v[0-9]+\.[0-9]+\.[0-9]+$) before echoing "sharphound_version=…" /
"azurehound_version=…" to GITHUB_OUTPUT; if validation fails, emit a clear error
via echo "::error::" and exit non-zero so the action fails fast.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
BHCE should automatically fetch the latest collector versions to bundle into image.
Just recipes and cd workflow call github /releases/latest endpoints to fetch latest version, and use resolved version to fetch and bundle latest collector artifacts.
Motivation and Context
Resolves BED-7545
This removes the need for manual collector version bumps in dockerfile during release week. Once collectors are released the latest versions will be pulled automatically on next run.
How Has This Been Tested?
test workflow ran with automatic collector resolution.
just recipes resolve latest versions and docker commands succeed.
Screenshots (optional):
Types of changes
Checklist:
Summary by CodeRabbit
New Features
Chores