__test-workflow-docker-build-images.yml

---
name: Test for "docker-build-images" workflow
run-name: Test for "docker-build-images" workflow

on: # yamllint disable-line rule:truthy
  workflow_call:

permissions:
  contents: read
  issues: read
  packages: write
  pull-requests: read
  id-token: write

# jscpd:ignore-start
jobs:
  arrange:
    name: Arrange
    runs-on: ubuntu-latest
    steps:
      - run: |
          if [ -z "${{ secrets.GITHUB_TOKEN }}" ]; then
            echo "GitHub token secret is not set"
            exit 1
          fi

  act-build-images:
    name: Act - Build multi-arch and mono-arch images
    needs: arrange
    uses: ./.github/workflows/docker-build-images.yml
    secrets:
      oci-registry-password: ${{ secrets.GITHUB_TOKEN }}
      build-secret-github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
    with:
      # First image is multi arch
      # Second image is mono arch
      # Default caching
      images: |
        [
          {
            "name": "test-multi-arch",
            "context": ".",
            "dockerfile": "./tests/application/Dockerfile",
            "build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
            "target": "base",
            "platforms": ["linux/amd64","linux/arm64","linux/arm/v7"]
          },
          {
            "name": "test-mono-arch",
            "context": ".",
            "dockerfile": "./tests/application/Dockerfile",
            "build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
            "target": "base",
            "platforms": ["linux/amd64"],
            "tag": "0.1.0"
          }
        ]

  assert-build-arch-mono-arch:
    name: Assert - multi-arch and mono-arch builds
    needs: act-build-images
    runs-on: "ubuntu-latest"
    steps:
      - name: Assert - built images output
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const assert = require("assert");

            const builtImagesOutput = `${{ needs.act-build-images.outputs.built-images }}`;
            assert(builtImagesOutput.length, `"built-images" output is empty`);

            // Check if is valid Json
            let builtImages = null;
            try {
              builtImages = JSON.parse(builtImagesOutput);
            } catch (error) {
              throw new Error(`"built-images" output is not a valid JSON: ${error}`);
            }

            const expectedCreatedImages = [
              "test-multi-arch",
              "test-mono-arch"
            ];
            assert(typeof builtImages === "object" && !Array.isArray(builtImages), `"built-images" output is not an object`);
            assert.equal(Object.keys(builtImages).length, expectedCreatedImages.length, `"built-images" output does not contain ${expectedCreatedImages.length} images`);

            for (const image of expectedCreatedImages) {
              assert(builtImages[image], `"built-images" output does not contain "${image}" image`);
            }

            const applicationMultiArchImage = builtImages["test-multi-arch"];

            assert.equal(applicationMultiArchImage.name, "test-multi-arch");
            assert.equal(applicationMultiArchImage.registry, "ghcr.io");
            assert.equal(applicationMultiArchImage.repository,"hoverkraft-tech/ci-github-container/test-multi-arch");
            assert.match(applicationMultiArchImage.digest, /^sha256:[0-9a-f]{64}$/);

            assert(applicationMultiArchImage.tags.length);
            assert(applicationMultiArchImage.images.length);
            applicationMultiArchImage.images.forEach(
              image => assert.match(
                image,
                /^ghcr\.io\/hoverkraft-tech\/ci-github-container\/test-multi-arch:[\.a-z0-9-]+@sha256:[0-9a-f]{64}$/
              )
            );

            assert.equal(applicationMultiArchImage.platforms.length, 3);
            assert(applicationMultiArchImage.platforms.includes("linux/amd64"));
            assert(applicationMultiArchImage.platforms.includes("linux/arm64"));
            assert(applicationMultiArchImage.platforms.includes("linux/arm/v7"));

            const applicationMonoArchImage = builtImages["test-mono-arch"];

            assert.equal(applicationMonoArchImage.name, "test-mono-arch");
            assert.equal(applicationMonoArchImage.registry, "ghcr.io");
            assert.equal(
              applicationMonoArchImage.repository,
              "hoverkraft-tech/ci-github-container/test-mono-arch"
            );
            assert.match(applicationMonoArchImage.digest, /^sha256:[0-9a-f]{64}$/);

            assert.equal(applicationMonoArchImage.tags.length, 1);
            assert.equal(applicationMonoArchImage.images.length, 1);
            assert.equal(
              applicationMonoArchImage.images[0],
              `ghcr.io/hoverkraft-tech/ci-github-container/test-mono-arch:0.1.0@${applicationMonoArchImage.digest}`
            );
            assert.equal(applicationMonoArchImage.platforms.length, 1);
            assert(applicationMonoArchImage.platforms.includes("linux/amd64"));

      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ github.token }}

      - name: Assert - multi-arch docker image and manifest
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const assert = require("assert");

            const image = `${{ fromJson(needs.act-build-images.outputs.built-images).test-multi-arch.images[0] }}`;

            await exec.exec('docker', ['pull', image]);

            let manifestOutput = null;
            const {
              exitCode,
              stdout,
              stderr
            } = await exec.getExecOutput('docker', ['manifest', 'inspect', '-v', image]);

            if (exitCode !== 0 || stderr) {
              throw new Error(`Failed to inspect manifest for image: ${image}: ${stderr || stdout}`);
            }

            manifest = JSON.parse(stdout);

            // Check if all platforms are valid
            const expectedPlatforms = [
              { os: "linux", architecture: "amd64", variant: undefined },
              { os: "linux", architecture: "arm64", variant: undefined },
              { os: "linux", architecture: "arm", variant: "v7" }
            ];

            assert.equal(manifest.length, expectedPlatforms.length, `Expected ${expectedPlatforms.length} platforms, got: ${manifest.length}`);

            expectedPlatforms.forEach(expectedPlatform => {
              const platformExists = manifest.some(
                platform => (
                  platform?.Descriptor?.platform?.architecture === expectedPlatform.architecture &&
                  platform?.Descriptor?.platform?.os === expectedPlatform.os &&
                  platform?.Descriptor?.platform?.variant === expectedPlatform.variant
                )
              );

              assert(
                platformExists,
                `Expected platform not found: os=${expectedPlatform.os},architecture=${expectedPlatform.architecture},variant=${expectedPlatform.variant}`
              );
            });

            // Check annotations
            const annotations = manifest[0]?.OCIManifest?.annotations;
            assert(annotations, `Failed to get annotations for image: ${image}`);

            // Check expected annotations
            const expectedAnnotations = {
              "org.opencontainers.image.source": "https://github.com/hoverkraft-tech/ci-github-container",
              "org.opencontainers.image.title": "ci-github-container",
              "org.opencontainers.image.url": "https://github.com/hoverkraft-tech/ci-github-container"
            };

            Object.entries(expectedAnnotations).forEach(([key, value]) => {
              assert.equal(annotations[key], value, `Expected annotation not found: ${key}`);
            });

      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Assert - signed multi-arch docker image
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const images = ${{ toJson(fromJson(needs.act-build-images.outputs.built-images).test-multi-arch.images) }};

            for(const image of images) {
              await exec.exec(
                'cosign',
                [
                  'verify', image,
                  '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com',
                  '--certificate-identity-regexp', 'https://github.com/hoverkraft-tech/ci-github-container',
                ]
              );
            }

      - name: Assert - mono-arch docker image
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const assert = require("assert");

            const image = `${{ fromJson(needs.act-build-images.outputs.built-images).test-mono-arch.images[0] }}`;

            await exec.exec('docker', ['pull', image]);

            let manifestOutput = null;
            const {
              exitCode,
              stdout,
              stderr
            } = await exec.getExecOutput('docker', ['manifest', 'inspect', '-v', image]);

            if (exitCode !== 0 || stderr) {
              throw new Error(`Failed to inspect manifest for image: ${image}: ${stderr || stdout}`);
            }

            manifest = JSON.parse(stdout);

            // Check if all platforms are valid
            const expectedPlatforms = [
              { os: "linux", architecture: "amd64", variant: undefined }
            ];

            assert.equal(manifest.length, expectedPlatforms.length, `Expected ${expectedPlatforms.length} platforms, got: ${manifest.length}`);

            expectedPlatforms.forEach(expectedPlatform => {
              const platformExists = manifest.some(
                platform => (
                  platform?.Descriptor?.platform?.architecture === expectedPlatform.architecture &&
                  platform?.Descriptor?.platform?.os === expectedPlatform.os &&
                  platform?.Descriptor?.platform?.variant === expectedPlatform.variant
                )
              );

              assert(
                platformExists,
                `Expected platform not found: os=${expectedPlatform.os},architecture=${expectedPlatform.architecture},variant=${expectedPlatform.variant}`
              );
            });

      - name: Assert - signed mono-arch docker image
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const images = ${{ toJson(fromJson(needs.act-build-images.outputs.built-images).test-mono-arch.images) }};

            for(const image of images) {
              await exec.exec(
                'cosign',
                [
                  'verify', image,
                  '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com',
                  '--certificate-identity-regexp', 'https://github.com/hoverkraft-tech/ci-github-container',
                ]
              );
            }

  act-build-args-secrets-and-registry-caching:
    name: Act - Build with args, secrets and registry caching
    needs: arrange
    uses: ./.github/workflows/docker-build-images.yml
    secrets:
      oci-registry-password: ${{ secrets.GITHUB_TOKEN }}
      build-secrets: |
        SECRET_TEST=test-secret
        SECRET_ANOTHER_TEST=another-test-secret
      build-secret-github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
    with:
      cache-type: registry
      images: |
        [
          {
            "name": "test-build-args-secrets",
            "context": ".",
            "target": "test",
            "dockerfile": "./tests/application/Dockerfile",
            "platforms": ["linux/amd64","linux/arm64"],
            "build-args": {
              "BUILD_RUN_ID": "${{ github.run_id }}",
              "BUILD_ARG_TEST": "test-arg",
              "BUILD_ARG_ANOTHER_TEST": "another-test-arg"
            },
            "secret-envs": {
              "SECRET_ENV_TEST": "GITHUB_ACTION",
              "SECRET_ENV_ANOTHER_TEST": "GITHUB_JOB"
            }
          }
        ]
      build-secret-github-app-id: ${{ vars.CI_BOT_APP_ID }}
      build-secret-github-app-token-env: |
        SECRET_ENV_GITHUB_APP_TOKEN_1
        SECRET_ENV_GITHUB_APP_TOKEN_2

  assert-build-args-secrets-and-registry-caching:
    name: Assert - Build with args, secrets and registry caching
    needs: act-build-args-secrets-and-registry-caching
    runs-on: "ubuntu-latest"
    steps:
      - name: Check built images ouput
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const assert = require("assert");

            const builtImagesOutput = `${{ needs.act-build-args-secrets-and-registry-caching.outputs.built-images }}`;
            assert(builtImagesOutput.length, `"built-images" output is empty`);

            // Check if is valid Json
            let builtImages = null;
            try {
              builtImages = JSON.parse(builtImagesOutput);
            } catch (error) {
              throw new Error(`"built-images" output is not a valid JSON: ${error}`);
            }

            const expectedCreatedImages = [
              "test-build-args-secrets"
            ];

            assert(typeof builtImages === "object" && !Array.isArray(builtImages), `"built-images" output is not an object`);
            assert.equal(Object.keys(builtImages).length, expectedCreatedImages.length, `"built-images" output does not contain ${expectedCreatedImages.length} images`);

            for (const image of expectedCreatedImages) {
              assert(builtImages[image], `"built-images" output does not contain "${image}" image`);
            }
      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ github.token }}

      - name: Check docker image and cache
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const assert = require("assert");

            let expectedTag;

            const isPullRequest = `${{ github.event_name }}` === "pull_request";
            if (isPullRequest) {
              const shortSha = `${{ github.sha }}`.substring(0, 7);
              expectedTag = `pr-${{ github.event.pull_request.number }}-${shortSha}`;
            } else {
              expectedTag = `${{ github.ref_name }}`;
            }

            const digest = `${{ fromJson(needs.act-build-args-secrets-and-registry-caching.outputs.built-images).test-build-args-secrets.digest }}`;
            assert(digest.length, `"built-images" output does not contain digest for "test-build-args-secrets" image`);
            assert.match(digest, /^sha256:[0-9a-f]{64}$/, `"built-images" output does not contain valid digest for "test-build-args-secrets" image`);

            const expectedImage = `ghcr.io/hoverkraft-tech/ci-github-container/test-build-args-secrets`;
            const expectedImageTag = `${expectedImage}:${expectedTag}@${digest}`;

            const image = `${{ fromJson(needs.act-build-args-secrets-and-registry-caching.outputs.built-images).test-build-args-secrets.images[0] }}`;

            assert.equal(image, expectedImageTag, `"built-images" output is not valid. Expected "${expectedImage}", got "${image}"`);

            await exec.exec('docker', ['pull', image]);

            let expectedCacheTag;

            if (isPullRequest) {
              expectedCacheTag = `pr-${{ github.event.pull_request.number }}`;
            } else {
              expectedCacheTag = `${{ github.ref_name }}`;
            }

            const cacheImage = `${expectedImage}/cache:${expectedCacheTag}`;

            const cacheImages = [
              `${cacheImage}-linux-arm64`,
              `${cacheImage}-linux-amd64`
            ];

            for (const cacheImage of cacheImages) {
              await exec.exec('docker', ['manifest', 'inspect', cacheImage]);
            }

# jscpd:ignore-end