__test-workflow-docker-build-images-caching.yml

---
name: Test for "docker-build-images" workflow - Caching
run-name: Test for "docker-build-images" workflow - Caching

on: # yamllint disable-line rule:truthy
  workflow_call:

permissions: {}

# jscpd:ignore-start
jobs:
  arrange:
    name: Arrange
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.define-matrix.outputs.result }}
    steps:
      - run: |
          if [ -z "${{ secrets.GITHUB_TOKEN }}" ]; then
            echo "GitHub token secret is not set"
            exit 1
          fi

      - id: define-matrix
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          result-encoding: json
          script: |
            const matrix = {
              include: [
                {
                  name: "mono-arch - registry",
                  "image-name": `test-caching-mono-arch-registry`,
                  platforms: '["linux/amd64"]',
                  "cache-type": "registry"
                },
                {
                  name: "multi-arch - registry",
                  "image-name": `test-caching-multi-arch-registry`,
                  platforms: '["linux/amd64","linux/arm64"]',
                  "cache-type": "registry"
                },
                {
                  name: "mono-arch - gha",
                  "image-name": `test-caching-mono-arch-gha`,
                  platforms: '["linux/amd64"]',
                  "cache-type": "gha"
                },
                {
                  name: "multi-arch - gha",
                  "image-name": `test-caching-multi-arch-gha`,
                  platforms: '["linux/amd64","linux/arm64"]',
                  "cache-type": "gha"
                }
              ]
            };
            return matrix;

  act-build-images-registry:
    name: Act - Build images - registry cache
    needs: arrange
    uses: ./.github/workflows/docker-build-images.yml
    permissions:
      contents: read
      id-token: write
      issues: read
      packages: write
      pull-requests: read
    secrets:
      oci-registry-password: ${{ secrets.GITHUB_TOKEN }}
      build-secret-github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
    with:
      cache-type: "registry"
      sign: false
      images: |
        [
          {
            "name": "test-caching-mono-arch-registry",
            "context": ".",
            "dockerfile": "./tests/application/Dockerfile",
            "build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
            "target": "prod",
            "platforms": ["linux/amd64"]
          },
          {
            "name": "test-caching-multi-arch-registry",
            "context": ".",
            "dockerfile": "./tests/application/Dockerfile",
            "build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
            "target": "prod",
            "platforms": ["linux/amd64","linux/arm64"]
          }
        ]

  act-build-images-gha:
    name: Act - Build images - gha cache
    needs: arrange
    uses: ./.github/workflows/docker-build-images.yml
    permissions:
      contents: read
      id-token: write
      issues: read
      packages: write
      pull-requests: read
    secrets:
      oci-registry-password: ${{ secrets.GITHUB_TOKEN }}
      build-secret-github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
    with:
      cache-type: "gha"
      sign: false
      images: |
        [
          {
            "name": "test-caching-mono-arch-gha",
            "context": ".",
            "dockerfile": "./tests/application/Dockerfile",
            "build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
            "target": "prod",
            "platforms": ["linux/amd64"]
          },
          {
            "name": "test-caching-multi-arch-gha",
            "context": ".",
            "dockerfile": "./tests/application/Dockerfile",
            "build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
            "target": "prod",
            "platforms": ["linux/amd64","linux/arm64"]
          }
        ]

  assert-images-cache:
    name: Assert - Cached images (${{ matrix.name }})
    needs: [arrange, act-build-images-registry, act-build-images-gha]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.arrange.outputs.matrix) }}
    permissions:
      packages: read
    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ github.token }}

      - name: Assert image and digest
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          BUILT_IMAGES: ${{ needs[matrix.cache-type == 'registry' && 'act-build-images-registry' || 'act-build-images-gha' ].outputs.built-images }}
          EXPECTED_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image-name }}
          IMAGE_NAME: ${{ matrix.image-name }}
        with:
          script: |
            const assert = require("assert");
            const pullRequestNumber = context.payload.pull_request?.number;
            const refName = process.env.GITHUB_REF_NAME;

            let expectedTag;

            const isPullRequest = context.eventName === "pull_request";
            if (isPullRequest) {
              const shortSha = context.sha.substring(0, 7);
              expectedTag = `pr-${pullRequestNumber}-${shortSha}`;
            } else {
              expectedTag = refName;
            }

            const builtImages = JSON.parse(process.env.BUILT_IMAGES);

            const imageName = process.env.IMAGE_NAME;
            assert(builtImages[imageName], `"built-images" output does not contain "${imageName}" image`);

            const digest = builtImages[imageName].digest;
            assert(digest.length, `"built-images" output does not contain digest for "${imageName}" image`);
            assert.match(digest, /^sha256:[0-9a-f]{64}$/, `"built-images" output does not contain valid digest for "${imageName}" image`);

            const expectedImage = process.env.EXPECTED_IMAGE;
            const expectedImageTag = `${expectedImage}:${expectedTag}@${digest}`;

            const image = builtImages[imageName].images[0];

            assert.equal(image, expectedImageTag, `"built-images" output is not valid. Expected "${expectedImage}", got "${image}"`);

            await exec.exec('docker', ['pull', image]);

      - name: Assert registry cache usage
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        if: ${{ matrix.cache-type == 'registry' }}
        env:
          EXPECTED_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.image-name }}
          EXPECTED_PLATFORMS: ${{ matrix.platforms }}
          EXPECTED_CACHE_TAG: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
        with:
          script: |
            const shouldAssertCache = context.eventName === 'pull_request'
              || (context.eventName === 'push' && !context.ref.startsWith('refs/tags/'));

            if (!shouldAssertCache) {
              core.info(`Skipping cache assertion for ${context.eventName} on ${context.ref}.`);
              return;
            }

            const expectedCacheImage = `${process.env.EXPECTED_IMAGE}/cache:${process.env.EXPECTED_CACHE_TAG}`;
            const expectedPlatforms = JSON.parse(process.env.EXPECTED_PLATFORMS);
            const expectedCacheImages = expectedPlatforms.map(platform => `${expectedCacheImage}-${platform.replace('/', '-')}`);

            for (const cacheImage of expectedCacheImages) {
              await exec.exec('docker', ['manifest', 'inspect', cacheImage]);
            }

# jscpd:ignore-end