Don't push before test is complete

[MalteMagnussen]

Question: How do we ensure that the test runs first, and passes successfully, before we push to the image registry?

# Company base image
target "ubuntu" {
  context = "ci/ubuntu"
  name = sanitize("ubuntu_${ubuntu_version.to}_${release.target}")
  tags = ["${HARBOR_REGISTRY_PREFIX}/ci/ubuntu:${ubuntu_version.to}"]
  dockerfile = "Dockerfile"
  matrix = {
    ubuntu_version = [
      {
        from = "noble"
        to = "noble-rootless"
      },
      {
        from = "jammy"
        to = "jammy-rootless"
      },
      {
        from = "focal"
        to = "focal-rootless"
      }
    ]
    release = [
      {
        target = "test"
        output = "cacheonly"
      }
      #{
      #  target = "release"
      #  output = "registry"
      #}
    ]
  }
  args = {
    # Docker language server does not like this line.... It says:
    # "'FROM_TAG' not defined as an ARG in your Dockerfile"
    FROM_TAG = ubuntu_version.from
  }
  output = [{ type = release.output }]
  target = release.target
  inherits = ["_common"]
}

# Using the first non-ubuntu target, to explain what is going on.
# The "target" is kinda like a makefile target.
target "go" {
  # https://github.com/docker/buildx/discussions/3082#discussioncomment-12652630
  # You need different names when using a matrix.
  name = sanitize("go_${go_version}_${ubuntu_version}_${release.target}")
  # The docker tags to use for the image.
  tags = ["${HARBOR_REGISTRY_PREFIX}/ci/go:${go_version}-${ubuntu_version}"]
  dockerfile = "ci/go/Dockerfile"
  # Using the ubuntu target as a context. So you can do "FROM" in the Dockerfile
  # and use the ubuntu target above as a base.
  contexts = {
    group-one-ubuntu = "target:ubuntu_${ubuntu_version}_${release.target}"
  }
  # Like in GitLab CI, you can use a Matrix to build multiple versions of the same image.
  # You can run "docker buildx bake --print > buildx_bake.json" to see all the images.
  matrix = {
    go_version = ["1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.20","1.21","1.22","1.23","1.24"],
    ubuntu_version = ["focal-rootless", "jammy-rootless", "noble-rootless"]
    release = [
      {
        target = "test"
        output = "cacheonly"
      }
      #{
      #  target = "release"
      #  output = "registry"
      #}
    ]
  }
  # The args to pass to the Dockerfile.
  args = {
    SOFTWARE_VER = go_version
  }
  # Buildkit can output many different things.
  # For testing, we only save to cache.
  # For release, we push to the registry.
  output = [{ type = release.output }]
  # Target is the stage in the Dockerfile to build.
  # It is a bit confusing that a docker buildx bake target is not the same as a docker build target.
  target = release.target
  inherits = ["_common"]
}

# 100+ images after this, using the same pattern.

And the Golang Dockerfile

FROM group-one-ubuntu AS release

USER 0
RUN apt-get-and-cleanup pkg-config libc6-dev

# Install go from upstream to allow us to pick the exact version from $SOFTWARE_VER
ARG SOFTWARE_VER
# Do some go-version processing to get latest patch version, if not specified
RUN GO_VER=${SOFTWARE_VER}; \
    if [ $(echo ${GO_VER} | awk -F '.' '{print NF}') -eq 2 ]; then \
      GREP_VER=$(echo "${GO_VER}" | awk -F '.' '{print $1 "\\." $2}'); \
      PATCH=$(curl --silent 'https://go.dev/dl/?mode=json&include=all' \
                | jq '.[] | select(.stable==true).version' | tr -d '"' \
                | awk -F '.' "/go${GREP_VER}\.[0-9]+/ {print \$3}" \
                | sort | tail -1 \
      ); \
      GO_VER="${SOFTWARE_VER}.${PATCH}"; \
    fi; \
    wget --quiet https://golang.org/dl/go$GO_VER.linux-amd64.tar.gz && \
    tar -C /usr/local -xzf go$GO_VER.linux-amd64.tar.gz && \
    rm -f go$GO_VER.linux-amd64.tar.gz

ENV PATH=$PATH:/usr/local/go/bin:/home/builder/go/bin
ENV GOPROXY=https://goproxy.one.com,https://proxy.golang.org,direct

USER 1000

# Install go-junit-report, to be used thus:
#
#     go test -v ./... | tee test-output.txt || true
#     go-junit-report --set-exit-code < test-output.txt > report.xml
#
# The XML file can be uploaded to gitlab under `artifacts.reports.junit`.
# Pre Go 1.16, we have to use `go get`, otherwise `go install ...@latest`
RUN go get github.com/jstemmer/go-junit-report || go install github.com/jstemmer/go-junit-report@latest


FROM release AS test

RUN which apt-get-and-cleanup
RUN which go
RUN go version
RUN which git g++ gcc make pkg-config
RUN test ${GOPROXY} = "https://goproxy.one.com,https://proxy.golang.org,direct"
RUN which go-junit-report

So we have a "test" stage, where we check that everything is working as intended in the image.

I was inspired to do this because of this Article: https://docs.docker.com/guides/bake/#testing-and-linting

[MalteMagnussen]

How do we only run the tests on MR's, and only push if we are on main?

We really need the ability to split up the tests from the push.

[MalteMagnussen]

I removed the "release" from the "matrix" and the "output" and the "target" from the bake file.

Instead I define it in CI

test:
- docker buildx bake --set=*.target=test --set=*.output=type=cacheonly --builder=remote --progress=quiet 

release:
- docker buildx bake --set=*.target=release --set=*.output=type=registry --builder=remote --progress=quiet 

But how do we ensure that the cache from the "test" is used in release? Probably have to look into "cache-from" and "cache-to"