sleeper/.github/workflows/docker-image-test.yaml at develop · gchq/sleeper · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
on:
  workflow_call:
    inputs:
      imageName:
        required: true
        type: string
      isLambda:
        default: false
        required: false
        type: boolean
      testClassNames:
        required: false
        type: string
      dockerOptions:
        required: false
        type: string
      trivyIgnore:
        default: code-style/.trivyignore.yaml
        required: false
        type: string

env:
  BASE_IMAGE: localhost:5000/base:test
  RUST_BUILD_IMAGE_X86_64: "ghcr.io/gchq/sleeper-rust-builder-x86_64-sccache:latest"
  RUST_BUILD_IMAGE_AARCH64: "ghcr.io/gchq/sleeper-rust-builder-aarch64-sccache:latest"
  SCCACHE_GHA_ENABLED: "true"
  SSCACHE_CACHE_SIZE: "2G"

jobs:
  build:
    name: Test Docker image ${{ inputs.imageName }}
    runs-on: ubuntu-latest

    services:
      registry:
        image: registry:3
        ports:
          - 5000:5000

    steps:
      - name: Delete huge unnecessary tools folder
        run: |
          rm -rf /opt/hostedtoolcache
          rm -rf /usr/share/dotnet
          rm -rf /opt/ghc
          rm -rf "/usr/local/share/boost"
          rm -rf "$AGENT_TOOLSDIRECTORY"
      - uses: actions/checkout@v6
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver-opts: network=host
          name: sleeper
      - uses: actions/setup-java@v5
        with:
          java-version: '17'
          distribution: 'corretto'
      - uses: mozilla-actions/sccache-action@v0.0.10
      - name: Cache dependencies
        uses: actions/cache/restore@v5
        with:
          path: ${{ runner.temp }}/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Resolve dependencies
        run: mvn de.qaware.maven:go-offline-maven-plugin:resolve-dependencies -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
        working-directory: ./java
      - name: Build with Maven
        run: mvn --batch-mode install -Pquick -T 1C -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
        working-directory: ./java
      - name: Copy build output
        working-directory: ./scripts/build
        run: ./copyBuildOutput.sh
      - name: Build base image
        run: ./scripts/dev/buildDockerImage.sh base ${{ env.BASE_IMAGE }} ${{ inputs.dockerOptions }} --builder sleeper --push
      - name: Build Docker image ${{ inputs.imageName }}
        run: ./scripts/dev/buildDockerImage.sh ${{ inputs.imageName }} ${{ inputs.imageName }}:test --lambda=${{ inputs.isLambda }} ${{ inputs.dockerOptions }} --builder sleeper --load --build-arg BASE_IMAGE=${{ env.BASE_IMAGE }}
      - name: Delete build output to free disk space
        run: |
          rm -rf ./scripts/docker
          rm -rf ./scripts/jars
      - name: Docker image tests
        working-directory: ./java
        if: ${{ inputs.testClassNames != '' }}
        run: mvn verify -PsystemTest -DskipRust=true -pl clients "-DrunIT=${{ inputs.testClassNames }}" -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
      - name: Run Trivy vulnerability scanner
        env:
          TRIVY_IGNOREFILE: ${{ inputs.trivyIgnore }}
          TRIVY_SHOW_SUPPRESSED: true
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: '${{ inputs.imageName }}:test'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          version: latest