ci/container: add lightweight image smoke tests

Why: a successful Docker build catches syntax and packaging problems,
but it does not verify that the packaged startup/config contracts still
work for the image roles.

Impact: the container build workflow now runs short-lived config
validation smoke tests for the user-facing image family when relevant
container files change.

Before/After: container CI only built the images; it now also exercises
each role with representative environment values and `rsyslogd -N1`.

Technical Overview:
The workflow now records the CI image tag once during the build step and
reuses it for a dedicated smoke-test step.

The smoke runs stay lightweight: they validate the packaged startup path
and config for `minimal`, `standard`, `collector`, `dockerlogs`, and
`etl` without requiring external services.

Images whose startup/config expects environment values receive small
representative settings so the workflow tests realistic role-specific
contracts rather than only the default happy path.

With the help of AI-Agents: Codex

Author: rgerhards

.github/workflows/container_build.yml

@@ -45,13 +45,53 @@ jobs:
         # full image family whenever container packaging inputs change.
         # CI intentionally uses a non-release `ci-<sha>` tag. Stable release
         # workflows must inject their own explicit release version instead.
+        id: build_containers
         if: >-
           ${{ github.event_name == 'workflow_dispatch' ||
           steps.container_changes.outputs.any_changed == 'true' }}
         run: |
           short_sha="$(git rev-parse --short=12 HEAD)"
+          echo "short_sha=${short_sha}" >> "$GITHUB_OUTPUT"
           make -C packaging/docker/rsyslog all VERSION="ci-${short_sha}"
 
+      - name: Smoke-test rsyslog container family
+        # Keep smoke coverage lightweight: validate the packaged startup and
+        # config contracts for each role without requiring external services.
+        # These runs are short-lived and use representative environment values
+        # for images whose entrypoint/config expects them.
+        if: >-
+          ${{ github.event_name == 'workflow_dispatch' ||
+          steps.container_changes.outputs.any_changed == 'true' }}
+        run: |
+          tag="ci-${{ steps.build_containers.outputs.short_sha }}"
+
+          docker run --rm \
+            "rsyslog/rsyslog-minimal:${tag}" \
+            rsyslogd -N1 -f /etc/rsyslog.conf
+
+          docker run --rm \
+            "rsyslog/rsyslog:${tag}" \
+            rsyslogd -N1 -f /etc/rsyslog.conf
+
+          docker run --rm \
+            -e ENABLE_RELP=on \
+            "rsyslog/rsyslog-collector:${tag}" \
+            rsyslogd -N1 -f /etc/rsyslog.conf
+
+          docker run --rm \
+            -e REMOTE_SERVER_NAME=collector \
+            -e REMOTE_SERVER_PORT=514 \
+            "rsyslog/rsyslog-dockerlogs:${tag}" \
+            rsyslogd -N1 -f /etc/rsyslog.conf
+
+          docker run --rm \
+            -e VESPA_NAMESPACE=default \
+            -e VESPA_DOCTYPE=logs \
+            -e VESPA_SERVER=vespa \
+            -e VESPA_PORT=8080 \
+            "rsyslog/rsyslog-etl:${tag}" \
+            rsyslogd -N1 -f /etc/rsyslog.conf
+
       - name: Skip container build, no relevant changes
         # This step is intentionally successful so the workflow can participate
         # in branch protection without forcing container rebuilds on unrelated