framework7-core/Dockerfile at main · swaplab-engine/framework7-core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# ===================================================================
# SWAPLAB ENGINE: FRAMEWORK7 CORE (PUBLIC BASE IMAGE)
# Repo: swaplab-engine/framework7-core
# Description: Public base image providing a transparent, secure, and
# pre-configured environment for Framework7 (Cordova-based) builds.
# Supports both Android (APK/AAB) & iOS (Xcode Project) workflows.
# ===================================================================
FROM ubuntu:22.04 AS framework7-core

ENV DEBIAN_FRONTEND=noninteractive
ENV LANG=en_US.UTF-8
ENV COCOAPODS_ALLOW_ROOT=true

# -------------------------------------------------------------------
# 1. System Dependencies Installation (Hybrid: Android & iOS Support)
# -------------------------------------------------------------------
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    openjdk-21-jdk \
    jq \
    python3 \
    python3-pip \
    unzip \
    curl \
    clamav \
    clamav-daemon \
    zip \
    git \
    locales \
    wget \
    gnupg \
    lsb-release \
    apt-transport-https \
    # iOS Dependencies (Ruby is required for CocoaPods)
    ruby-full \
    build-essential \
    && rm -rf /var/lib/apt/lists/* \
    && locale-gen en_US.UTF-8

RUN freshclam

# ===================================================================
# 🛡️ SECURITY TRANSPARENCY POLICY
# ===================================================================
# At SwapLab, we prioritize supply chain security. Every build process
# is scanned in real-time using the tools installed below.
#
# ENFORCEMENT POLICY:
# If ClamAV (Virus), Trivy (Dependency), or Semgrep (Code) detects any
# CRITICAL THREATS, the build process will be IMMEDIATELY ABORTED.
#
# PUBLIC TRANSPARENCY:
# To ensure accountability, details of the threats causing the build failure
# are logged publicly (isolated & anonymized) on our Security Dashboard.
# Customers can verify our system integrity here:
#
# 📊 Dashboard: https://security-stats.swaplab.net
# ===================================================================

# -------------------------------------------------------------------
# 2. Security Tools Installation
# -------------------------------------------------------------------
# Trivy (SCA - Software Composition Analysis)
# Used to scan for vulnerabilities in OS packages and NPM dependencies.
RUN wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor -o /usr/share/keyrings/trivy.gpg && \
    echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" > /etc/apt/sources.list.d/trivy.list && \
    apt-get update && \
    apt-get install -y --no-install-recommends trivy && \
    rm -rf /var/lib/apt/lists/*

# Semgrep (SAST - Static Application Security Testing)
# Used to scan source code for insecure patterns and potential exploits.
RUN pip3 install semgrep

# -------------------------------------------------------------------
# 3. Android SDK & Build Tools Installation
# -------------------------------------------------------------------
ARG ANDROID_SDK_VERSION=11076708
ARG ANDROID_BUILD_TOOLS_VERSION=35.0.0
ARG ANDROID_PLATFORM_VERSION=35
ENV ANDROID_HOME=/usr/lib/android-sdk
ENV PATH=$PATH:${ANDROID_HOME}/cmdline-tools/latest/bin:${ANDROID_HOME}/platform-tools

RUN mkdir -p ${ANDROID_HOME}/cmdline-tools && \
    curl -o android_tools.zip https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_SDK_VERSION}_latest.zip && \
    unzip -d ${ANDROID_HOME}/cmdline-tools android_tools.zip && \
    mv ${ANDROID_HOME}/cmdline-tools/cmdline-tools ${ANDROID_HOME}/cmdline-tools/latest && \
    rm android_tools.zip

RUN yes | sdkmanager --licenses && \
    sdkmanager --install "platform-tools" "platforms;android-${ANDROID_PLATFORM_VERSION}" "build-tools;${ANDROID_BUILD_TOOLS_VERSION}"

# -------------------------------------------------------------------
# 4. Gradle Installation
# -------------------------------------------------------------------
ARG GRADLE_VERSION=8.11.1
ENV GRADLE_HOME=/opt/gradle/gradle-${GRADLE_VERSION}
RUN curl -o gradle.zip -L https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip && \
    unzip -d /opt/gradle gradle.zip && \
    rm gradle.zip

# -------------------------------------------------------------------
# 5. Node.js, CLI Tools, and iOS Support
# -------------------------------------------------------------------
# Install Node.js 20 LTS
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
    && apt-get update && apt-get install -y --no-install-recommends nodejs \
    && rm -rf /var/lib/apt/lists/*

# Install Framework7 CLI & Cordova CLI (Global)
# Framework7 requires Cordova for native compilation.
RUN npm install -g cordova framework7-cli

# Install CocoaPods (Required for iOS native dependencies handling)
RUN gem install cocoapods

# Final Environment Variables Setup
ENV GRADLE_USER_HOME=/github/workspace/.gradle
ENV PATH=${PATH}:${GRADLE_HOME}/bin

# Verification Command
CMD ["framework7", "--version"]