Skip to content

Commit 5dc22de

Browse files
neilimeneilime
committed
test(docker-build-images): assert use of build-args and secrets
Signed-off-by: Emilien Escalle <[email protected]>
1 parent 2a6358f commit 5dc22de

File tree

5 files changed

+91
-32
lines changed

5 files changed

+91
-32
lines changed

‎.github/workflows/__main-ci.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ jobs:
3333
[
3434
"application-test",
3535
"test-multi-arch",
36-
"test-mono-arch"
36+
"test-mono-arch",
37+
"test-build-args-secrets"
3738
]
3839
3940
release:

‎.github/workflows/__test-workflow-docker-build-images.yml‎

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,27 +28,43 @@ jobs:
2828
uses: ./.github/workflows/docker-build-images.yml
2929
secrets:
3030
oci-registry-password: ${{ secrets.GITHUB_TOKEN }}
31+
build-secrets: |
32+
SECRET_REPOSITORY_OWNER=${{ github.repository_owner }}
33+
SECRET_REPOSITORY=${{ github.repository }}
3134
with:
32-
# First image is multi arch, multi build-args
33-
# Second image is mono arch, single build-args
35+
# First image is multi arch
36+
# Second image is mono arch
37+
# Third image tests build args, secrets
3438
images: |
3539
[
3640
{
3741
"name": "test-multi-arch",
3842
"context": ".",
3943
"dockerfile": "./tests/application/Dockerfile",
40-
"build-args": { "PROD_MODE": "true", "BUILD_ID": "${{ github.run_id }}" },
44+
"build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
4145
"target": "prod",
4246
"platforms": ["linux/amd64","linux/arm64","linux/arm/v7"]
4347
},
4448
{
4549
"name": "test-mono-arch",
4650
"context": ".",
4751
"dockerfile": "./tests/application/Dockerfile",
48-
"build-args": { "PROD_MODE": "true" },
52+
"build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
4953
"target": "prod",
5054
"platforms": ["linux/amd64"],
5155
"tag": "0.1.0"
56+
},
57+
{
58+
"name": "test-build-args-secrets",
59+
"context": ".",
60+
"target": "test",
61+
"dockerfile": "./tests/application/Dockerfile",
62+
"platforms": ["linux/amd64"],
63+
"build-args": {
64+
"BUILD_RUN_ID": "${{ github.run_id }}",
65+
"BUILD_REPOSITORY_OWNER": "${{ github.repository_owner }}",
66+
"BUILD_REPOSITORY": "${{ github.repository }}"
67+
}
5268
}
5369
]
5470
@@ -73,10 +89,17 @@ jobs:
7389
throw new Error(`"built-images" output is not a valid JSON: ${error}`);
7490
}
7591
92+
const expectedCreatedImages = [
93+
"test-multi-arch",
94+
"test-mono-arch",
95+
"test-build-args-secrets"
96+
];
7697
assert(typeof builtImages === "object" && !Array.isArray(builtImages), `"built-images" output is not an object`);
77-
assert.equal(Object.keys(builtImages).length, 2, `"built-images" output does not contain 2 images`);
98+
assert.equal(Object.keys(builtImages).length, expectedCreatedImages.length, `"built-images" output does not contain ${expectedCreatedImages.length} images`);
7899
79-
assert(builtImages["test-multi-arch"], `"built-images" output does not contain "test-multi-arch" image`);
100+
for (const image of expectedCreatedImages) {
101+
assert(builtImages[image], `"built-images" output does not contain "${image}" image`);
102+
}
80103
81104
const applicationMultiArchImage = builtImages["test-multi-arch"];
82105
assert.equal(applicationMultiArchImage.name, "test-multi-arch");

‎.github/workflows/docker-build-images.md‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -64,20 +64,26 @@ jobs:
6464
# Default: "${{ github.repository_owner }}"
6565
oci-registry-username: ""
6666

67-
# Images to build parameters. Json array of objects.
68-
# Example: [{
69-
# "name": "application",
70-
# "dockerfile": "./docker/application/Dockerfile",
71-
# "build-args": { "APP_PATH": "./application/", "PROD_MODE": "true" },
72-
# "target": "prod",
73-
# "platforms": [
67+
# Images to build parameters. Json array of objects.
68+
# Example: [
69+
# {
70+
# "name": "application",
71+
# "context": ".",
72+
# "dockerfile": "./docker/application/Dockerfile",
73+
# "target": "prod",
74+
# "build-args": {
75+
# "APP_PATH": "./application/",
76+
# "PROD_MODE": "true"
77+
# },
78+
# "platforms": [
7479
# "linux/amd64",
7580
# {
76-
# "name": "darwin/amd64",
77-
# "runs-on": "macos-latest"
81+
# "name": "darwin/amd64",
82+
# "runs-on": "macos-latest"
7883
# }
79-
# ]
80-
# }]
84+
# ]
85+
# }
86+
# ]
8187
images: ""
8288
```
8389
@@ -86,23 +92,23 @@ jobs:
8692
8793
## Secrets
8894
89-
| **Secret** | **Description** |
90-
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
91-
| **<code>oci-registry-password</code>** | Password or GitHub token (packages:read and packages:write scopes) used to log against the OCI registry. See <https://github.com/docker/login-action#usage>. |
95+
| **Secret** | **Description** |
96+
| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
97+
| **<code>oci-registry-password</code>** | Password or GitHub token (`packages:read` and `packages:write` scopes) used to log against the OCI registry. See <https://github.com/docker/login-action#usage>. |
9298

9399
<!-- end secrets -->
94100
<!-- start inputs -->
95101

96102
## Inputs
97103

98-
| **Input** | **Description** | **Default** | **Required** |
99-
| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- | ------------ |
100-
| **<code>runs-on</code>** | Json array of runner(s) to use. See <https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job> | <code>["ubuntu-latest"]</code> | **false** |
101-
| **<code>oci-registry</code>** | OCI registry where to pull and push images | <code>ghcr.io</code> | **false** |
102-
| **<code>oci-registry-username</code>** | Username used to log against the OCI registry. See <https://github.com/docker/login-action#usage> | <code>${{ github.repository_owner }}</code> | **false** |
103-
| **<code>images</code>** | Images to build parameters. | | **true** |
104-
| | Example: <code>[{"name": "application","context": ".","dockerfile": "./docker/application/Dockerfile","build-args": { "APP_PATH": "./application/", "PROD_MODE": "true" },"target": "prod","platforms": ["linux/amd64",{"name": "darwin/amd64","runs-on": "macos-latest"}]}]</code> | | |
105-
| **<code>lfs</code>** | Enable Git LFS. See <https://github.com/actions/checkout?tab=readme-ov-file#usage>. | <code>true</code> | **false** |
104+
| **Input** | **Description** | **Default** | **Required** |
105+
| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- | ------------ |
106+
| **<code>runs-on</code>** | Json array of runner(s) to use. See <https://docs.github.com/en/actions/using-jobs/choosing-the-runner-for-a-job> | <code>["ubuntu-latest"]</code> | **false** |
107+
| **<code>oci-registry</code>** | OCI registry where to pull and push images | <code>ghcr.io</code> | **false** |
108+
| **<code>oci-registry-username</code>** | Username used to log against the OCI registry. See <https://github.com/docker/login-action#usage> | <code>${{ github.repository_owner }}</code> | **false** |
109+
| **<code>images</code>** | Images to build parameters. | | **true** |
110+
| | Example: <code>[{ "name": "application", "context": ".", "dockerfile": "./docker/application/Dockerfile", "target": "prod", "build-args": { "APP_PATH": "./application/", "PROD_MODE": "true" }, "platforms": ["linux/amd64", { "name": "darwin/amd64", "runs-on": "macos-latest" }] }]</code> | | |
111+
| **<code>lfs</code>** | Enable Git LFS. See <https://github.com/actions/checkout?tab=readme-ov-file#usage>. | <code>true</code> | **false** |
106112

107113
<!-- end inputs -->
108114

@@ -114,8 +120,8 @@ jobs:
114120
| **<code>repository</code>** | Repository name. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **false** |
115121
| **<code>context</code>** | Build context. See [Docker build-image action](../../actions/docker/build-image/README.md) | <code>.</code> | **false** |
116122
| **<code>dockerfile</code>** | Location of Dockerfile. See [Docker build-image action](../../actions/docker/build-image/README.md) | <code>Dockerfile</code> | **false** |
117-
| **<code>build-args</code>** | List of build-time variables. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **false** |
118123
| **<code>target</code>** | Sets the target stage to build. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **true** |
124+
| **<code>build-args</code>** | List of build-time variables. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **false** |
119125
| **<code>platforms</code>** | List of platforms to build for. It is used as `platform` in [Docker build-image action](../../actions/docker/build-image/README.md). Can be a string (Example: `linux/amd64`) or an object (Example: `{"name": "darwin/amd64","runs-on": "macos-latest"}`) | | **true** |
120126

121127
#### Platforms entry parameters

‎.github/workflows/docker-build-images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,11 @@ on: # yamllint disable-line rule:truthy
6060
"name": "application",
6161
"context": ".",
6262
"dockerfile": "./docker/application/Dockerfile",
63+
"target": "prod",
6364
"build-args": {
6465
"APP_PATH": "./application/",
6566
"PROD_MODE": "true"
6667
},
67-
"target": "prod",
6868
"platforms": [
6969
"linux/amd64",
7070
{

‎tests/application/Dockerfile‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,33 @@ HEALTHCHECK --interval=5s --timeout=3s --retries=3 CMD ["/healthcheck"]
44

55
USER test
66

7-
FROM base AS prod
7+
FROM base AS prod
8+
9+
FROM alpine:3 AS test
10+
11+
# Create user and group
12+
RUN addgroup -S test && adduser -S test -G test
13+
14+
ENV EXPECTED_REPOSITORY_OWNER=hoverkraft-tech
15+
ENV EXPECTED_REPOSITORY=hoverkraft-tech/ci-github-container
16+
17+
ARG BUILD_RUN_ID
18+
RUN test -n "$BUILD_RUN_ID" || (echo "Error: BUILD_RUN_ID is not set" && exit 1);
19+
20+
# Test that the build args are set
21+
ARG BUILD_REPOSITORY_OWNER
22+
RUN test -n "$BUILD_REPOSITORY_OWNER" || (echo "Error: BUILD_REPOSITORY_OWNER is not set" && exit 1);
23+
RUN test "$BUILD_REPOSITORY_OWNER" = "$EXPECTED_REPOSITORY_OWNER" || (echo "Error: BUILD_REPOSITORY_OWNER is not \"$EXPECTED_REPOSITORY_OWNER\"" && exit 1);
24+
25+
ARG BUILD_REPOSITORY
26+
RUN test -n "$BUILD_REPOSITORY" || (echo "Error: BUILD_REPOSITORY is not set" && exit 1);
27+
RUN test "$BUILD_REPOSITORY" = "$EXPECTED_REPOSITORY" || (echo "Error: BUILD_REPOSITORY is not \"$EXPECTED_REPOSITORY\"" && exit 1);
28+
29+
# Test that secrets are passed
30+
RUN --mount=type=secret,id=SECRET_REPOSITORY_OWNER test -f /run/secrets/SECRET_REPOSITORY_OWNER || (echo "Error: SECRET_REPOSITORY_OWNER is not set" && exit 1);
31+
RUN --mount=type=secret,id=SECRET_REPOSITORY_OWNER test "$(cat /run/secrets/SECRET_REPOSITORY_OWNER)" = "$EXPECTED_REPOSITORY_OWNER" || (echo "Error: SECRET_REPOSITORY_OWNER is not \"$EXPECTED_REPOSITORY_OWNER\"" && exit 1);
32+
33+
RUN --mount=type=secret,id=SECRET_REPOSITORY test -f /run/secrets/SECRET_REPOSITORY || (echo "Error: SECRET_REPOSITORY is not set" && exit 1);
34+
RUN --mount=type=secret,id=SECRET_REPOSITORY test "$(cat /run/secrets/SECRET_REPOSITORY)" = "$EXPECTED_REPOSITORY" || (echo "Error: SECRET_REPOSITORY is not \"$EXPECTED_REPOSITORY\"" && exit 1);
35+
36+
USER test

0 commit comments

Comments
 (0)