Build and push rootless docker container

.github/workflows/build-test-docker.yaml

@@ -23,6 +23,10 @@ on:
         type: string
         description: Dockerfile to build
         default: Dockerfile
+      target:
+        required: true
+        type: string
+        description: Dockerfile target to build
       enable-tests:
         required: true
         type: boolean
@@ -46,6 +50,10 @@ on:
         required: true
         type: string
         description: Dockerfile to build
+      target:
+        required: true
+        type: string
+        description: Dockerfile target to build
       enable-tests:
         required: true
         type: boolean
@@ -71,6 +79,8 @@ jobs:
         uses: docker/metadata-action@v4
         with:
           images: ${{ inputs.repository-name }}
+          flavor: |
+            latest=false # pass latest tag in inputs
           tags: ${{ inputs.docker-tags }}
       - uses: depot/setup-action@v1
       - name: Build image
@@ -83,6 +93,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           file: ${{ inputs.file }}
+          target: ${{ inputs.target }}
           buildx-fallback: true
       - name: Load image
         if: ${{ inputs.enable-tests }}

.github/workflows/release.yml

@@ -95,11 +95,27 @@ jobs:
       docker-tags: |
         type=semver,pattern={{version}}
         type=semver,pattern={{major}}.{{minor}}
+        type=raw,value=latest
       repository-name: ${{ github.repository }}
       artifact-name: image-release
       file: Dockerfile
+      target: semgrep-cli
       enable-tests: true
 
+  build-test-docker-rootless:
+    uses: ./.github/workflows/build-test-docker.yaml
+    secrets: inherit
+    with:
+      docker-tags: |
+        type=semver,pattern={{version}},suffix=-rootless
+        type=semver,pattern={{major}}.{{minor}},suffix=-rootless
+        type=raw,value=latest-rootless
+      repository-name: ${{ github.repository }}
+      artifact-name: image-release-rootless
+      file: Dockerfile
+      target: rootless
+      enable-tests: false
+
   build-test-osx-x86:
     uses: ./.github/workflows/build-test-osx-x86.yaml
     secrets: inherit
@@ -128,6 +144,7 @@ jobs:
     needs:
       [
         build-test-docker,
+        build-test-docker-rootless,
         build-test-manylinux-x86,
         build-test-manylinux-aarch64,
         build-test-osx-x86,
@@ -146,6 +163,15 @@ jobs:
       repository-name: ${{ github.repository }}
       dry-run: ${{ needs.inputs.outputs.dry-run == 'true' }}
 
+  push-docker-rootless:
+    needs: [wait-for-build-test, inputs]
+    uses: ./.github/workflows/push-docker.yaml
+    secrets: inherit
+    with:
+      artifact-name: image-release-rootless
+      repository-name: ${{ github.repository }}
+      dry-run: ${{ needs.inputs.outputs.dry-run == 'true' }}
+
   upload-wheels:
     name: Upload Wheels to PyPI
     runs-on: ubuntu-latest

.github/workflows/tests.yml

@@ -315,6 +315,7 @@ jobs:
       artifact-name: image-test
       repository-name: ${{ github.repository }}
       file: Dockerfile
+      target: semgrep-cli
       enable-tests: true
 
   push-docker:
@@ -327,6 +328,33 @@ jobs:
       repository-name: ${{ github.repository }}
       dry-run: false
 
+  build-docker-rootless:
+    uses: ./.github/workflows/build-test-docker.yaml
+    secrets: inherit
+    with:
+      docker-tags: |
+        type=semver,pattern={{version}},suffix=-rootless
+        type=semver,pattern={{major}}.{{minor}},suffix=-rootless
+        type=ref,event=pr,suffix=-rootless
+        type=ref,event=branch,suffix=-rootless
+        type=sha,event=branch,suffix=-rootless
+        type=edge,suffix=-rootless
+      artifact-name: image-test-rootless
+      repository-name: ${{ github.repository }}
+      file: Dockerfile
+      target: rootless
+      enable-tests: false
+
+  push-docker-rootless:
+    needs: [build-docker-rootless]
+    uses: ./.github/workflows/push-docker.yaml
+    if: github.ref == 'refs/heads/develop' || (github.actor != 'dependabot[bot]' && !(github.event.pull_request.head.repo.full_name != github.repository))
+    secrets: inherit
+    with:
+      artifact-name: image-test-rootless
+      repository-name: ${{ github.repository }}
+      dry-run: false
+
   test-semgrep-pro:
     needs: [build-test-docker, push-docker]
     uses: ./.github/workflows/test-semgrep-pro.yaml

Dockerfile

@@ -232,3 +232,6 @@ RUN printf "[safe]\n	directory = /src"  > ~semgrep/.gitconfig && \
 # to interactively explore the docker image.
 CMD ["semgrep", "--help"]
 LABEL maintainer="support@semgrep.com"
+
+FROM semgrep-cli AS rootless
+USER semgrep