Feature/build dev container

.devcontainer/Dockerfile

@@ -0,0 +1,100 @@
+FROM eclipse-temurin:26-jdk-resolute
+
+LABEL org.opencontainers.image.title="WrongSecrets Dev Container"
+LABEL org.opencontainers.image.description="Development environment for OWASP WrongSecrets"
+LABEL org.opencontainers.image.source="https://github.com/OWASP/wrongsecrets"
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# ---------------------------------------------------------------------------
+# Base development tooling
+# ---------------------------------------------------------------------------
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        git \
+        gnupg \
+        jq \
+        make \
+        openssh-client \
+        python3 \
+        python3-pip \
+        unzip \
+        wget \
+        zip \
+    && rm -rf /var/lib/apt/lists/*
+
+# ---------------------------------------------------------------------------
+# Node.js
+# ---------------------------------------------------------------------------
+
+RUN curl -fsSL https://deb.nodesource.com/setup_26.x | bash - \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends nodejs \
+    && node --version \
+    && npm --version \
+    && rm -rf /var/lib/apt/lists/*
+
+# ---------------------------------------------------------------------------
+# Go
+# ---------------------------------------------------------------------------
+
+ARG GO_VERSION=1.27.1
+
+RUN curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-$(dpkg --print-architecture).tar.gz" \
+        -o /tmp/go.tar.gz \
+    && rm -rf /usr/local/go \
+    && tar -C /usr/local -xzf /tmp/go.tar.gz \
+    && rm /tmp/go.tar.gz
+
+ENV GOPATH="/go"
+ENV PATH="/usr/local/go/bin:/go/bin:${PATH}"
+
+RUN mkdir -p /go \
+    && go version \
+    && go env GOPATH
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2
+RUN go install github.com/securego/gosec/v2/cmd/gosec@latest
+
+# ---------------------------------------------------------------------------
+# Terraform
+# ---------------------------------------------------------------------------
+
+RUN install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL https://apt.releases.hashicorp.com/gpg \
+        | gpg --dearmor -o /etc/apt/keyrings/hashicorp-archive-keyring.gpg \
+    && chmod a+r /etc/apt/keyrings/hashicorp-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(. /etc/os-release && echo "$VERSION_CODENAME") main" \
+        > /etc/apt/sources.list.d/hashicorp.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends terraform \
+    && terraform version \
+    && rm -rf /var/lib/apt/lists/*
+
+# ---------------------------------------------------------------------------
+# Docker CLI + Compose
+# ---------------------------------------------------------------------------
+
+RUN install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
+        | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
+    && chmod a+r /etc/apt/keyrings/docker.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+        > /etc/apt/sources.list.d/docker.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+        docker-ce-cli \
+        docker-compose-plugin \
+    && docker --version \
+    && docker compose version \
+    && rm -rf /var/lib/apt/lists/*
+
+# ---------------------------------------------------------------------------
+# Workspace
+# ---------------------------------------------------------------------------
+
+WORKDIR /workspace

.devcontainer/devcontainer.json

@@ -1,37 +1,32 @@
 {
-  "name": "OWASP WrongSecrets (Java 26 & Node.js 26 Dev Container)",
-  "image": "eclipse-temurin:26-jdk-resolute", //resolute
+  "name": "WrongSecrets",
+
+  "image": "ghcr.io/owasp/wrongsecrets-devcontainer:26-resolute",
+
+  "workspaceFolder": "/workspace",
+
   "features": {
-    "ghcr.io/devcontainers/features/node:2": {
-      "version": "26",
-      "npmVersion": "11.19.0"
-    },
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.12"
-    },
-    "ghcr.io/devcontainers/features/terraform:1.5.0": {
-      "version": "latest",
-      "tflint": "latest"
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "installZsh": true,
+      "configureZshAsDefaultShell": true
     },
-    "ghcr.io/devcontainers-extra/features/terraform-docs:1": {},
+
     "ghcr.io/devcontainers/features/docker-in-docker:4.1.0": {
       "enableOnStartup": true,
       "version": "latest",
-        "moby": false
-    },
-    "ghcr.io/devcontainers/features/go:1": {
-        "version": "1.22"
-    },
-    "ghcr.io/devcontainers/features/git:1": {},
-    "ghcr.io/devcontainers/features/common-utils:2": {
-      "installZsh": true,
-      "configureZshAsDefaultShell": true
+      "moby": false
     }
   },
+
   "containerEnv": {
     "DEVCONTAINER_SECRET": "WSECR-devcontainer-token-774921"
   },
-  "forwardPorts": [8080, 8090],
+
+  "forwardPorts": [
+    8080,
+    8090
+  ],
+
   "portsAttributes": {
     "8080": {
       "label": "WrongSecrets Web UI",
@@ -42,6 +37,7 @@
       "onAutoForward": "silent"
     }
   },
+
   "customizations": {
     "vscode": {
       "extensions": [
@@ -67,6 +63,6 @@
       }
     }
   },
-  "postCreateCommand": "chmod +x ./mvnw && ./mvnw dependency:resolve -DskipTests && npm install && pip install pre-commit && pre-commit install && pre-commit install --hook-type commit-msg",
-  "remoteUser": "root"
+
+  "postCreateCommand": ".devcontainer/post-create.sh"
 }

.devcontainer/post-create.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -e
+
+chmod +x ./mvnw
+
+./mvnw dependency:resolve -DskipTests
+
+npm install
+
+pre-commit install
+pre-commit install --hook-type commit-msg

.github/workflows/build-devcontainer.yml

@@ -0,0 +1,72 @@
+name: Build Dev Container
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - ".devcontainer/Dockerfile"
+      - ".devcontainer/devcontainer.json"
+      - ".github/workflows/build-devcontainer.yml"
+
+  pull_request:
+    paths:
+      - ".devcontainer/Dockerfile"
+      - ".devcontainer/devcontainer.json"
+      - ".github/workflows/build-devcontainer.yml"
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    name: Build dev container
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/owasp/wrongsecrets-devcontainer
+          tags: |
+            type=raw,value=26-resolute
+            type=sha
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: .devcontainer/Dockerfile
+
+          platforms: |
+            linux/amd64
+            linux/arm64
+
+          push: ${{ github.event_name != 'pull_request' }}
+
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/sort-contributors-go.yml

@@ -30,8 +30,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
+          go-version: '1.27.1'
           go-version-file: scripts/sort_contibutors/go.mod
           cache-dependency-path: scripts/sort_contibutors/go.mod
 
@@ -46,11 +47,14 @@ jobs:
 
       - name: Install golangci-lint
         run: |
-          go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
       - name: Lint
         run: make lint
 
       - name: Security
-        run: make security
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@latest
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+          make security

Dockerfile

@@ -9,6 +9,9 @@ RUN java -Djarmode=tools -jar application.jar extract --layers --destination ext
 FROM eclipse-temurin:26-jre-alpine
 WORKDIR /application
 
+LABEL org.opencontainers.image.title="OWASP WrongSecrets"
+LABEL org.opencontainers.image.source="https://github.com/OWASP/wrongsecrets"
+
 ARG argBasedPassword="default"
 ARG spring_profile=""
 ARG challenge59_webhook_url="YUhSMGNITTZMeTlvYjI5cmN5NXpiR0ZqYXk1amIyMHZjMlZ5ZG1salpYTXZWREEwVkRRd1RraFlMMEl3T1VSQlRrb3lUamRMTDJNeWFqYzFSVEUzVjFrd2NFeE5SRXRvU0RsbGQzZzBhdz09"

README.md

@@ -4,7 +4,7 @@
 
 [![Tweet](https://img.shields.io/badge/-Twitter-%232B90D9?style=for-the-badge&logo=x&logoColor=white)](https://twitter.com/intent/tweet?text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this&url=https://github.com/OWASP/wrongsecrets&hashtags=secretsmanagement,secrets,hunting,p0wnableapp,OWASP,WrongSecrets) [<img src="https://img.shields.io/badge/-MASTODON-%232B90D9?style=for-the-badge&logo=mastodon&logoColor=white">](https://tootpick.org/#text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this%0A%0Ahttps://github.com/OWASP/wrongsecrets%20%23secretsmanagement,%20%23secrets,%20%23hunting,%20%23p0wnableapp,%20%23OWASP,%20%23WrongSecrets) [<img src="https://img.shields.io/badge/-BLUESKY-%230085FF?style=for-the-badge&logo=bluesky&logoColor=white">](https://bsky.app/intent/compose?text=Want%20to%20dive%20into%20secrets%20management%20and%20do%20some%20hunting?%20try%20this%0A%0Ahttps://github.com/OWASP/wrongsecrets%20%23secretsmanagement%20%23secrets%20%23hunting%20%23p0wnableapp%20%23OWASP%20%23WrongSecrets) [<img src="https://img.shields.io/badge/-LINKEDIN-0077B5?style=for-the-badge&logo=linkedin&logoColor=white">](https://www.linkedin.com/shareArticle/?url=https://www.github.com/OWASP/wrongsecrets&title=OWASP%20WrongSecrets)
 
-[![Java checkstyle and testing](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml) [![Pre-commit](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml) [![Terraform FMT](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![CodeQL](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml) [![Dead Link Checker](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml) [![Javadoc and Swaggerdoc generator](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml) [![Test Heroku with cypress](https://github.com/OWASP/wrongsecrets/actions/workflows/heroku_tests.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/heroku_tests.yml)
+[![Java checkstyle and testing](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/main.yml) [![Pre-commit](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pre-commit.yml) [![Terraform FMT](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/terraform.yml) [![CodeQL](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/codeql-analysis.yml) [![Dead Link Checker](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/link_checker.yml) [![Javadoc and Swaggerdoc generator](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/java_swagger_doc.yml) [![Test Heroku with cypress](https://github.com/OWASP/wrongsecrets/actions/workflows/heroku_tests.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/heroku_tests.yml) [![Build Dev Container](https://github.com/OWASP/wrongsecrets/actions/workflows/build-devcontainer.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/build-devcontainer.yml)
 
 [![Test minikube script (k8s)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-k8s-test.yml) [![Test minikube script (k8s&vault)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/minikube-vault-test.yml) [![Docker container test](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container_test.yml) [![Test container on podman](https://github.com/OWASP/wrongsecrets/actions/workflows/container-alts-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/container-alts-test.yml)
 [![DAST with ZAP](https://github.com/OWASP/wrongsecrets/actions/workflows/dast-zap-test.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/dast-zap-test.yml) [![PR Preview and Visual Diff](https://github.com/OWASP/wrongsecrets/actions/workflows/pr-preview.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/pr-preview.yml) [![Build Preview](https://github.com/OWASP/wrongsecrets/actions/workflows/build-preview.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/build-preview.yml) [![Visual Diff](https://github.com/OWASP/wrongsecrets/actions/workflows/visual-diff.yml/badge.svg)](https://github.com/OWASP/wrongsecrets/actions/workflows/visual-diff.yml)
@@ -16,7 +16,7 @@
 
 Welcome to the OWASP WrongSecrets game! The game is packed with real life examples of how to _not_ store secrets in your software. Each of these examples is captured in a challenge, which you need to solve using various tools and techniques. Solving these challenges will help you recognize common mistakes & can help you to reflect on your own secrets management strategy.
 
-Can you solve all the 69 challenges?
+Can you solve all the 71 challenges?
 
 Try some of them on [our Heroku demo environment](https://wrongsecrets.herokuapp.com/).
 
@@ -226,9 +226,10 @@ Now you can try to find the secrets by means of solving the challenge offered at
 -   [localhost:8080/challenge/challenge-64](http://localhost:8080/challenge/challenge-64)
 -   [localhost:8080/challenge/challenge-65](http://localhost:8080/challenge/challenge-65)
 -   [localhost:8080/challenge/challenge-66](http://localhost:8080/challenge/challenge-66)
--   [localhost:8080/challenge/challenge-68](http://localhost:8080/challenge/challenge-70)
--   [localhost:8080/challenge/challenge-69](http://localhost:8080/challenge/challenge-70)
+-   [localhost:8080/challenge/challenge-68](http://localhost:8080/challenge/challenge-68)
+-   [localhost:8080/challenge/challenge-69](http://localhost:8080/challenge/challenge-69)
 -   [localhost:8080/challenge/challenge-70](http://localhost:8080/challenge/challenge-70)
+-   [localhost:8080/challenge/challenge-71](http://localhost:8080/challenge/challenge-71)
 </details>
 
 Note that these challenges are still very basic, and so are their explanations. Feel free to file a PR to make them look
@@ -257,7 +258,7 @@ If you want to host WrongSecrets on Railway, you can do so by deploying [this on
 
 ## Basic K8s exercise
 
-_Can be used for challenges 0-6, 8, 12-43, 48-70_
+_Can be used for challenges 0-6, 8, 12-43, 48-71_
 
 ### Minikube based
 

scripts/sort_contibutors/go.mod

@@ -1,3 +1,3 @@
 module github.com/owasp/wrongsecrets/scripts/sort_contibutors
 
-go 1.22
+go 1.27.1