[GRDM-63591] Python 3.13・依存ライブラリの更新と unoserver コンテナの分離(第1段階)

.dockerignore

@@ -2,3 +2,4 @@
 *.pyc
 **/*.pyc
 Dockerfile
+*venv*

.github/scripts/ci/render-trivy-report.py

@@ -0,0 +1,128 @@
+import argparse
+import json
+from collections import Counter
+
+
+SEVERITIES = ('CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'UNKNOWN')
+SEVERITY_ORDER = {severity: index for index, severity in enumerate(SEVERITIES)}
+COMMENT_MARKER = '<!-- trivy-image-scan -->'
+
+
+def markdown_escape(value):
+    return str(value or '-').replace('\n', ' ').replace('|', '\\|')
+
+
+def get_vulnerabilities(report):
+    return [
+        vulnerability
+        for result in report.get('Results', [])
+        for vulnerability in result.get('Vulnerabilities') or []
+    ]
+
+
+def render_report(report, image, commit, run_url):
+    vulnerabilities = get_vulnerabilities(report)
+    counts = Counter(
+        vulnerability.get('Severity', 'UNKNOWN').upper()
+        for vulnerability in vulnerabilities
+    )
+    fixable_counts = Counter(
+        vulnerability.get('Severity', 'UNKNOWN').upper()
+        for vulnerability in vulnerabilities
+        if vulnerability.get('FixedVersion')
+    )
+
+    lines = [
+        COMMENT_MARKER,
+        '## Container image vulnerability scan',
+        '',
+        f'- Image: `{markdown_escape(image)}`',
+        f'- Commit: [`{commit[:12]}`]({run_url.rsplit("/actions/runs/", 1)[0]}/commit/{commit})',
+        f'- Workflow run: [details]({run_url})',
+        f'- Findings: **{len(vulnerabilities)}** '
+        f'({sum(fixable_counts.values())} with a fix available)',
+        '',
+        '| Severity | Total | Fix available |',
+        '| --- | ---: | ---: |',
+    ]
+    for severity in SEVERITIES:
+        lines.append(
+            f'| {severity} | {counts[severity]} | {fixable_counts[severity]} |',
+        )
+
+    important = sorted(
+        (
+            vulnerability
+            for vulnerability in vulnerabilities
+            if vulnerability.get('Severity', 'UNKNOWN').upper() in {'CRITICAL', 'HIGH'}
+        ),
+        key=lambda vulnerability: (
+            SEVERITY_ORDER.get(
+                vulnerability.get('Severity', 'UNKNOWN').upper(),
+                len(SEVERITIES),
+            ),
+            vulnerability.get('VulnerabilityID', ''),
+            vulnerability.get('PkgName', ''),
+        ),
+    )
+    lines.extend([
+        '',
+        '### High-priority findings',
+        '',
+    ])
+    if important:
+        lines.extend([
+            '| Severity | Vulnerability | Package | Installed | Fixed |',
+            '| --- | --- | --- | --- | --- |',
+        ])
+        for vulnerability in important[:20]:
+            lines.append(
+                '| {severity} | {identifier} | {package} | {installed} | {fixed} |'.format(
+                    severity=markdown_escape(vulnerability.get('Severity')),
+                    identifier=markdown_escape(vulnerability.get('VulnerabilityID')),
+                    package=markdown_escape(vulnerability.get('PkgName')),
+                    installed=markdown_escape(vulnerability.get('InstalledVersion')),
+                    fixed=markdown_escape(vulnerability.get('FixedVersion')),
+                ),
+            )
+        if len(important) > 20:
+            lines.extend([
+                '',
+                f'_Showing 20 of {len(important)} HIGH/CRITICAL findings._',
+            ])
+    else:
+        lines.append('No HIGH or CRITICAL findings were detected.')
+
+    lines.extend([
+        '',
+        '> This scan is currently reporting-only and establishes the vulnerability baseline.',
+        '> The complete JSON and SARIF reports are attached to the workflow run.',
+        '',
+    ])
+    return '\n'.join(lines)
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--input', required=True)
+    parser.add_argument('--output', required=True)
+    parser.add_argument('--image', required=True)
+    parser.add_argument('--commit', required=True)
+    parser.add_argument('--run-url', required=True)
+    args = parser.parse_args()
+
+    with open(args.input, encoding='utf-8') as report_file:
+        report = json.load(report_file)
+
+    rendered = render_report(
+        report,
+        image=args.image,
+        commit=args.commit,
+        run_url=args.run_url,
+    )
+    with open(args.output, 'w', encoding='utf-8') as output_file:
+        output_file.write(rendered)
+
+
+if __name__ == '__main__':
+    main()

.github/scripts/ci/run-tests.sh

@@ -11,17 +11,32 @@ TEST_BUILD="$1"
 REPO_ROOT=$(git rev-parse --show-toplevel)
 cd "$REPO_ROOT"
 
+NETWORK="mfr-tests-$$"
+docker network create "$NETWORK"
+cleanup() {
+    docker rm -f mfr-unoserver >/dev/null 2>&1 || true
+    docker network rm "$NETWORK" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+# Start the LibreOffice conversion server so the unoconv exporter tests run against the real thing
+docker run -d --name mfr-unoserver --network "$NETWORK" "${MFR_UNOSERVER_IMAGE}"
+for _ in $(seq 1 60); do
+    if docker logs mfr-unoserver 2>&1 | grep -q 'INFO:unoserver:Started.'; then
+        break
+    fi
+    sleep 1
+done
+docker logs mfr-unoserver 2>&1 | grep -q 'INFO:unoserver:Started.'
+
 read -r -d '' container_script <<'BASH' || true
-export WHEELHOUSE=$HOME/wheelhouse
-pip install --upgrade pip
-pip install setuptools==37.0.0
-pip install wheel==0.26.0
-pip install invoke==0.13.0
-invoke wheelhouse --develop
-invoke install --develop
+poetry install --without=docs --with=dev
 invoke test
 BASH
 
 docker run --rm -t \
+    --network "$NETWORK" \
     -e TEST_BUILD="$TEST_BUILD" \
-    ${MFR_TEST_IMAGE} bash -lc "$container_script"
+    -e MFR_UNOSERVER_TESTS=1 \
+    -e UNOSERVER_EXTENSION_CONFIG_HOST=mfr-unoserver \
+    ${MFR_TEST_IMAGE} bash -c "$container_script"

.github/workflows/unit-tests.yml

@@ -14,6 +14,8 @@ jobs:
       contents: read
     outputs:
       image: ${{ steps.meta.outputs.image }}
+      build_image: ${{ steps.meta.outputs.build_image }}
+      unoserver_image: ${{ steps.meta.outputs.unoserver_image }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -23,20 +25,180 @@ jobs:
         run: |
           docker build -t rdm-mfr-test:${{ github.sha }} -f ./Dockerfile .
 
+      - name: Build Docker image (build stage, used for unit tests)
+        run: |
+          docker build --target build -t rdm-mfr-build:${{ github.sha }} -f ./Dockerfile .
+
+      - name: Build Docker image (unoserver)
+        run: |
+          docker build -t rdm-unoserver-test:${{ github.sha }} -f ./Dockerfile.unoserver .
+
       - name: Save Docker image
         run: |
           docker save rdm-mfr-test:${{ github.sha }} -o /tmp/rdm-mfr-image.tar
 
+      - name: Save Docker image (build stage)
+        run: |
+          docker save rdm-mfr-build:${{ github.sha }} -o /tmp/rdm-mfr-build-image.tar
+
+      - name: Save Docker image (unoserver)
+        run: |
+          docker save rdm-unoserver-test:${{ github.sha }} -o /tmp/rdm-unoserver-image.tar
+
       - name: Upload Docker image artifact
         uses: actions/upload-artifact@v4
         with:
           name: rdm-mfr-image
           path: /tmp/rdm-mfr-image.tar
           retention-days: 1
 
+      - name: Upload Docker image artifact (build stage)
+        uses: actions/upload-artifact@v4
+        with:
+          name: rdm-mfr-build-image
+          path: /tmp/rdm-mfr-build-image.tar
+          retention-days: 1
+
+      - name: Upload Docker image artifact (unoserver)
+        uses: actions/upload-artifact@v4
+        with:
+          name: rdm-unoserver-image
+          path: /tmp/rdm-unoserver-image.tar
+          retention-days: 1
+
       - name: Export image reference
         id: meta
-        run: echo "image=rdm-mfr-test:${{ github.sha }}" >> "$GITHUB_OUTPUT"
+        run: |
+          echo "image=rdm-mfr-test:${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          echo "build_image=rdm-mfr-build:${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          echo "unoserver_image=rdm-unoserver-test:${{ github.sha }}" >> "$GITHUB_OUTPUT"
+
+  scan-image:
+    runs-on: ubuntu-latest
+    needs: build-image
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - name: mfr
+            artifact: rdm-mfr-image
+            image: ${{ needs.build-image.outputs.image }}
+          - name: unoserver
+            artifact: rdm-unoserver-image
+            image: ${{ needs.build-image.outputs.unoserver_image }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download Docker image artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ matrix.target.artifact }}
+          path: /tmp
+
+      - name: Scan Docker image with Trivy
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: image
+          input: /tmp/${{ matrix.target.artifact }}.tar
+          scanners: vuln
+          vuln-type: os,library
+          format: json
+          output: trivy-results.json
+          exit-code: '0'
+          list-all-pkgs: 'true'
+
+      - name: Convert Trivy report to SARIF
+        env:
+          TRIVY_SCANNERS: ''
+        run: |
+          trivy convert \
+            --format sarif \
+            --output trivy-results.sarif \
+            trivy-results.json
+
+      - name: Render vulnerability summary
+        env:
+          IMAGE: ${{ matrix.target.image }}
+          COMMIT: ${{ github.sha }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          python3 .github/scripts/ci/render-trivy-report.py \
+            --input trivy-results.json \
+            --output trivy-report.md \
+            --image "$IMAGE" \
+            --commit "$COMMIT" \
+            --run-url "$RUN_URL"
+          tee -a "$GITHUB_STEP_SUMMARY" < trivy-report.md
+
+      - name: Upload vulnerability reports
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-image-scan-${{ matrix.target.name }}
+          path: |
+            trivy-results.json
+            trivy-results.sarif
+            trivy-report.md
+          retention-days: 14
+
+      - name: Upload SARIF to GitHub Code Scanning
+        if: >-
+          github.event_name != 'pull_request' ||
+          github.event.pull_request.head.repo.full_name == github.repository
+        uses: github/codeql-action/upload-sarif@bce182f857edf1feab116e9795a3393d21977282 # v4
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy-container-image-${{ matrix.target.name }}
+
+  comment-image-scan:
+    runs-on: ubuntu-latest
+    needs: scan-image
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Download vulnerability summaries
+        uses: actions/download-artifact@v4
+        with:
+          pattern: trivy-image-scan-*
+          path: reports
+
+      - name: Combine summaries
+        run: |
+          set -euo pipefail
+          cat reports/trivy-image-scan-mfr/trivy-report.md reports/trivy-image-scan-unoserver/trivy-report.md > trivy-report.md
+
+      - name: Create or update PR comment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          comments_endpoint="repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments"
+          comment_id="$({
+            gh api --paginate "$comments_endpoint" --jq \
+              '.[] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- trivy-image-scan -->"))) | .id'
+          } | sed -n '1p')"
+          if [[ -n "$comment_id" ]]; then
+            gh api \
+              --method PATCH \
+              "repos/${GITHUB_REPOSITORY}/issues/comments/${comment_id}" \
+              -F body=@trivy-report.md
+          else
+            gh api \
+              --method POST \
+              "$comments_endpoint" \
+              -F body=@trivy-report.md
+          fi
 
   tests:
     runs-on: ubuntu-latest
@@ -52,20 +214,27 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Download Docker image artifact
+      - name: Download Docker image artifact (build stage)
         uses: actions/download-artifact@v4
         with:
-          name: rdm-mfr-image
+          name: rdm-mfr-build-image
+          path: /tmp
+
+      - name: Download Docker image artifact (unoserver)
+        uses: actions/download-artifact@v4
+        with:
+          name: rdm-unoserver-image
           path: /tmp
 
-      - name: Load Docker image
+      - name: Load Docker images
         run: |
-          docker load -i /tmp/rdm-mfr-image.tar
+          docker load -i /tmp/rdm-mfr-build-image.tar
+          docker load -i /tmp/rdm-unoserver-image.tar
 
       - name: Run matrix job
         env:
           TEST_BUILD: ${{ matrix.test_build }}
-          MFR_TEST_IMAGE: ${{ needs.build-image.outputs.image }}
+          MFR_TEST_IMAGE: ${{ needs.build-image.outputs.build_image }}
+          MFR_UNOSERVER_IMAGE: ${{ needs.build-image.outputs.unoserver_image }}
         run: |
           bash .github/scripts/ci/run-tests.sh "$TEST_BUILD"
-