noseyparker build tweaks

-noseyparker build tweaks

.github/workflows/docker-build-noseyparker.yml

@@ -9,11 +9,10 @@ on:
   #     - 'projects/noseyparker_scanner/**'
   #     - '.github/workflows/noseyparker-scanner-build.yml'
 
-
 env:
   REGISTRY: ghcr.io
-  IMAGE_PREFIX: "specterops/nemesis" # ${{ github.repository }} causes issues as SpecterOps is not all lowercase
-  PLATFORMS: linux/amd64,linux/arm64  # Added platforms (arm64 for Mac M1/M2/M3 and AWS images)
+  IMAGE_PREFIX: "specterops/nemesis"
+  PLATFORMS: linux/amd64,linux/arm64
 
 jobs:
   build-noseyparker-scanner:
@@ -36,14 +35,23 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-
-      # Cache Rust dependencies before Docker build
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
         with:
-          prefix-key: 'noseyparker-scanner'
-          workdir: ./projects/noseyparker_scanner
-          cache-on-failure: true
+          # Use larger instance for better performance
+          driver-opts: |
+            image=moby/buildkit:latest
+            network=host
+
+      # Pre-warm Rust registry cache
+      - name: Cache Rust registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-registry-
 
       - name: Log in to the Container registry
         uses: docker/login-action@v3
@@ -78,7 +86,8 @@ jobs:
             CARGO_INCREMENTAL=0
             CARGO_TERM_COLOR=always
             RUST_BACKTRACE=1
-          # Enhanced multi-layer caching strategy
+            CARGO_BUILD_JOBS=4
+          # Enhanced multi-layer caching with registry
           cache-from: |
             type=gha,scope=noseyparker-scanner-${{ github.ref_name }}
             type=gha,scope=noseyparker-scanner-main
@@ -92,22 +101,6 @@ jobs:
           # Test that the image runs and shows version
           docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/noseyparker-scanner:${{ steps.meta.outputs.version }} --help || true
 
-      # Optional: Security scan with Trivy
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/noseyparker-scanner:${{ steps.meta.outputs.version }}
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-        continue-on-error: true
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        if: always()
-        with:
-          sarif_file: 'trivy-results.sarif'
-        continue-on-error: true
-
       # Clean up cache on successful build to prevent cache bloat
       - name: Cleanup old cache entries
         if: success()

projects/noseyparker_scanner/Dockerfile.new

@@ -2,7 +2,7 @@
 FROM lukemathwalker/cargo-chef:latest-rust-1.86.0-slim-bookworm AS chef
 WORKDIR /app
 
-# Install build dependencies
+# Install build dependencies with optimizations
 RUN apt-get update && \
     apt-get install -y \
     build-essential \
@@ -11,54 +11,82 @@ RUN apt-get update && \
     pkg-config \
     libssl-dev \
     libboost-all-dev \
-    ragel && \
+    ragel \
+    ccache && \
     rm -rf /var/lib/apt/lists/*
 
+# Configure ccache for faster builds
+ENV CCACHE_DIR=/ccache
+ENV CC="ccache gcc"
+ENV CXX="ccache g++"
+RUN mkdir -p /ccache
+
 # Prepare recipe (cargo-chef planning phase)
 FROM chef AS planner
 COPY ./projects/noseyparker_scanner/ .
 RUN cargo chef prepare --recipe-path recipe.json
 
-# Build dependencies for dev
-FROM chef AS dev-deps
-COPY --from=planner /app/recipe.json recipe.json
-
-# Set optimization environment variables (from NoseyParker CI)
-ENV CARGO_INCREMENTAL=0 \
-    CARGO_TERM_COLOR=always \
-    RUST_BACKTRACE=1 \
-    CARGO_PROFILE_DEV_DEBUG=0
-
-# Build dependencies for dev
-RUN cargo chef cook --recipe-path recipe.json
-
-# Build dependencies for prod
+# Build dependencies for prod with maximum optimizations
 FROM chef AS prod-deps
 COPY --from=planner /app/recipe.json recipe.json
 
-# Set optimization environment variables (from NoseyParker CI)
+# Set aggressive optimization environment variables
 ENV CARGO_INCREMENTAL=0 \
     CARGO_TERM_COLOR=always \
     RUST_BACKTRACE=1 \
     CARGO_PROFILE_RELEASE_DEBUG=0 \
-    CARGO_PROFILE_RELEASE_LTO=false
+    CARGO_PROFILE_RELEASE_LTO=false \
+    CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1 \
+    CARGO_PROFILE_RELEASE_OPT_LEVEL=2 \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true \
+    CARGO_HTTP_MULTIPLEXING=false \
+    CARGO_BUILD_JOBS=4
 
-# Build dependencies for prod with optimized flags
-RUN cargo chef cook --locked --profile release --recipe-path recipe.json
+# Use faster linker if available
+RUN if [ "$(uname -m)" = "x86_64" ]; then \
+        apt-get update && apt-get install -y lld && \
+        echo '[target.x86_64-unknown-linux-gnu]\nlinker = "clang"\nrustflags = ["-C", "link-arg=-fuse-ld=lld"]' > ~/.cargo/config.toml; \
+    fi
+
+# Build dependencies for prod with optimized flags and parallel compilation
+RUN --mount=type=cache,target=/ccache \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    cargo chef cook --locked --profile release --recipe-path recipe.json
+
+# Development build target (optional, faster for testing)
+FROM chef AS dev-deps
+COPY --from=planner /app/recipe.json recipe.json
+
+ENV CARGO_INCREMENTAL=0 \
+    CARGO_TERM_COLOR=always \
+    RUST_BACKTRACE=1 \
+    CARGO_PROFILE_DEV_DEBUG=0 \
+    CARGO_BUILD_JOBS=4
+
+RUN --mount=type=cache,target=/ccache \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    cargo chef cook --recipe-path recipe.json
 
 # Development build target
 FROM dev-deps AS dev
 COPY ./projects/noseyparker_scanner/ .
 
-# Build with optimizations
 ENV CARGO_INCREMENTAL=0 \
     CARGO_PROFILE_DEV_DEBUG=0 \
     RUST_LOG=debug
 
-RUN cargo build
+RUN --mount=type=cache,target=/ccache \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    cargo build && \
+    cp target/debug/noseyparker-scanner /usr/local/bin/
 
-# Use development binary
-CMD ["/app/target/debug/noseyparker-scanner", "--log-level", "debug"]
+CMD ["noseyparker-scanner", "--log-level", "debug"]
 
 # Production build target
 FROM prod-deps AS build-prod
@@ -67,9 +95,15 @@ COPY ./projects/noseyparker_scanner/ .
 # Set production build optimizations
 ENV CARGO_INCREMENTAL=0 \
     CARGO_PROFILE_RELEASE_DEBUG=0 \
-    CARGO_PROFILE_RELEASE_LTO=false
+    CARGO_PROFILE_RELEASE_LTO=false \
+    CARGO_BUILD_JOBS=4
 
-RUN cargo build --locked --release
+RUN --mount=type=cache,target=/ccache \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/app/target \
+    cargo build --locked --release && \
+    cp target/release/noseyparker-scanner /usr/local/bin/
 
 # Slim runtime image for production
 FROM debian:12-slim AS prod
@@ -83,7 +117,7 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # Copy the built binary from build stage
-COPY --from=build-prod /app/target/release/noseyparker-scanner /usr/local/bin/noseyparker-scanner
+COPY --from=build-prod /usr/local/bin/noseyparker-scanner /usr/local/bin/noseyparker-scanner
 
 ENV RUST_LOG=info
 
@@ -92,7 +126,6 @@ CMD ["noseyparker-scanner", "--log-level", "info"]
 
 
 
-
 ## builds things from scratch
 # # Use cargo-chef as prepared image with exact tag
 # FROM lukemathwalker/cargo-chef:latest-rust-1.86.0-slim-bookworm AS chef