fix: used trustworthy Docker images

.ci/docker/Makefile

@@ -15,17 +15,20 @@ prepare-test: bats ## Prepare the bats dependencies
 	@git submodule sync
 	@git submodule update --init --recursive
 
-test-%: prepare-test ## Run the tests for the specific app
-	@DOCKERFILE=$* bats-core/bin/bats --tap tests | tee target/results.tap
+convert-tests-results: ## convert TAP test results to JUnit
 	@APP=$*; docker run --rm -e APP=$${APP} -v "$(CURDIR)":/usr/src/app -w /usr/src/app node:${LTS_ALPINE} \
 					sh -c 'npm install tap-xunit -g && cat target/results.tap | tap-xunit --package="co.elastic.pipeline.$${APP}" > target/junit-$${APP}-results.xml'
 
+test-%: prepare-test ## Run the tests for the specific app
+	@DOCKERFILE=$* bats-core/bin/bats --tap tests | tee target/results.tap
+	@$(MAKE) -s convert-tests-results
+
 push-%: prepare-test ## Push the Docker image to the docker.elastic.co repository
 	docker push "docker.elastic.co/observability-ci/$*"
 
-all-push: push-gren ## Push all Docker images to the docker.elastic.co repository
+all-push: push-gren push-yamllint push-shellcheck## Push all Docker images to the docker.elastic.co repository
 
-all-tests: test-gren ## Run the tests for all the apps
+all-tests: test-gren test-yamllint test-shellcheck## Run the tests for all the apps
 
 clean: ## Clean autogenerated files/folders
 	@rm -rf bats-core

.ci/docker/gren/Dockerfile

@@ -1,9 +1,9 @@
-FROM node:12-slim
+FROM node:12.7.0-stretch-slim
 
 RUN apt-get update -qq -y \
   && apt-get install -qq -y --no-install-recommends git \
   && rm -rf /var/lib/apt/lists/*
 
-RUN npm install github-release-notes -g
-
+RUN npm install github-release-notes@0.17.0 -g
+WORKDIR /app
 ENTRYPOINT [ "/usr/local/bin/gren" ]

.ci/docker/shellcheck/Dockerfile

@@ -0,0 +1,29 @@
+# Build-only image
+FROM ubuntu:18.04 AS build
+USER root
+WORKDIR /opt/shellCheck
+
+# Install OS deps
+RUN apt-get update -qq && apt-get install -qq -y ghc cabal-install git
+RUN git clone -n https://github.com/koalaman/shellcheck.git .\
+  && git checkout -B v0.6.0 cb57b4a74f490991e65ee8d0be1a6151a9819f91
+
+# Install Haskell deps
+RUN cabal update && cabal install --dependencies-only --ghc-options="-optlo-Os -split-sections"
+
+# Copy source and build it
+RUN cabal build Paths_ShellCheck && \
+  ghc -optl-static -optl-pthread -isrc -idist/build/autogen --make shellcheck -split-sections -optc-Wl,--gc-sections -optlo-Os && \
+  strip --strip-all shellcheck
+
+RUN mkdir -p /out/bin && \
+  cp shellcheck  /out/bin/
+
+# Resulting Alpine image
+FROM alpine:3.10.1
+COPY --from=build /out /
+RUN /bin/shellcheck -V
+WORKDIR /mnt
+
+ENTRYPOINT ["/bin/shellcheck"]
+CMD ["-V"]

.ci/docker/tests/tests.bats

@@ -22,7 +22,7 @@ CONTAINER="${DOCKERFILE//\//-}"
 }
 
 @test "${DOCKERFILE} - create test container" {
-	run docker run -d --name $CONTAINER -P ${IMAGE}
+	run docker run -d --name $CONTAINER -P ${IMAGE} ${CMD}
 	assert_success
 }
 

.ci/docker/yamllint/Dockerfile

@@ -0,0 +1,9 @@
+FROM python:3.7.4-alpine3.10
+
+WORKDIR /yaml
+
+RUN pip install yamllint==1.16.0 && \
+    rm -rf ~/.cache/pip
+
+ENTRYPOINT ["yamllint"]
+CMD ["--version"]

.ci/packer_cache.sh

@@ -22,7 +22,10 @@ source /usr/local/bin/bash_standard_lib.sh
 # docker.elastic.co/observability-ci/apm-integration-testing-tests-apm-server
 
 DOCKER_IMAGES="alpine:3.4
+alpine:3.10.1
 node:12-slim
+node:12.7.0-stretch-slim
+python:3.7.4-alpine3.10
 docker.elastic.co/observability-ci/yamllint
 docker.elastic.co/observability-ci/shellcheck
 docker.elastic.co/observability-ci/gren

.ci/scripts/gren

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 set -e
-docker run --rm -t -v "$(pwd):/app" -w /app docker.elastic.co/observability-ci/gren "$@"
+docker run --rm -t -v "$(pwd):/app" -u "$(id -u):$(id -g)" docker.elastic.co/observability-ci/gren "$@"

.ci/scripts/shellcheck

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 set -e
-docker run --rm -v "$PWD:/mnt" koalaman/shellcheck:stable "$@"
+docker run --rm -t -v "$PWD:/mnt" -u "$(id -u):$(id -g)" docker.elastic.co/observability-ci/shellcheck "$@"

.ci/scripts/yamllint

@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 set -e
-docker run --rm -v "$PWD:/yaml" sdesbure/yamllint yamllint "$@"
+docker run --rm -t -v "$PWD:/yaml" -u "$(id -u):$(id -g)" docker.elastic.co/observability-ci/yamllint "$@"