__test-workflow-docker-build-images.yml

---
name: Test for "docker-build-images" workflow
run-name: Test for "docker-build-images" workflow

on: # yamllint disable-line rule:truthy
  workflow_call:

permissions:
  contents: read
  issues: read
  packages: write
  pull-requests: read
  id-token: write

# jscpd:ignore-start
jobs:
  arrange:
    name: Arrange
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.define-matrix.outputs.result }}
    steps:
      - run: |
          if [ -z "${{ secrets.GITHUB_TOKEN }}" ]; then
            echo "GitHub token secret is not set"
            exit 1
          fi

      - id: define-matrix
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          result-encoding: json
          script: |
            let imageNamePrefix;

            if (context.eventName === "pull_request") {
              const pullRequestNumber = context.payload.pull_request?.number;
              if (!pullRequestNumber) {
                throw new Error("Pull request number is not available in the event payload");
              }
              imageNamePrefix = `pr-${pullRequestNumber}`;
            } else {
              imageNamePrefix = process.env.GITHUB_REF_NAME;
              if (!imageNamePrefix) {
                throw new Error("GITHUB_REF_NAME environment variable is not set");
              }
            }

            imageNamePrefix = `test-${imageNamePrefix}-${context.runNumber}`.replace(/\//g, "-");

            const tag = '0.1.0';

            const matrix = {
              include: [
                {
                  name: "mono-arch - signed",
                  "image-name": `${imageNamePrefix}-mono-arch-signed`,
                  platforms: '["linux/amd64"]',
                  sign: true,
                  tag
                },
                {
                  name: "multi-arch - signed",
                  "image-name": `${imageNamePrefix}-multi-arch-signed`,
                  platforms: '["linux/amd64","linux/arm64"]',
                  sign: true,
                  tag
                },
                {
                  name: "mono-arch - unsigned",
                  "image-name": `${imageNamePrefix}-mono-arch-unsigned`,
                  platforms: '["linux/amd64"]',
                  sign: false,
                  tag
                },
                {
                  name: "multi-arch - unsigned",
                  "image-name": `${imageNamePrefix}-multi-arch-unsigned`,
                  platforms: '["linux/amd64","linux/arm64"]',
                  sign: false,
                  tag
                }
              ]
            };
            return matrix;

  act-build-images:
    name: Act - Build images (${{ matrix.name }})
    needs: arrange
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.arrange.outputs.matrix) }}
    uses: ./.github/workflows/docker-build-images.yml
    secrets:
      oci-registry-password: ${{ secrets.GITHUB_TOKEN }}
      build-secret-github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
    with:
      sign: ${{ matrix.sign }}
      images: |
        [
          {
            "name": "${{ matrix.image-name }}",
            "context": ".",
            "dockerfile": "./tests/application/Dockerfile",
            "build-args": { "BUILD_RUN_ID": "${{ github.run_id }}" },
            "target": "base",
            "platforms": ${{ matrix.platforms }},
            "tag": "${{ matrix.tag }}"
          }
        ]

  assert-images-versions:
    name: Assert - Published images (${{ matrix.name }})
    needs: [arrange, act-build-images]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.arrange.outputs.matrix) }}
    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ github.token }}

      - name: Verify image exists
        env:
          IMAGE_NAME: "${{ matrix.image-name }}:${{ matrix.tag }}"
        run: |
          docker pull ghcr.io/hoverkraft-tech/ci-github-container/"${IMAGE_NAME}"

      - name: Verify package has correct number of versions
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          IMAGE_NAME: ${{ matrix.image-name }}
          SIGN: ${{ matrix.sign }}
          PLATFORMS: ${{ matrix.platforms }}
        with:
          script: |
            const assert = require("assert");
            const versions = await github.paginate(
              github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg,
              {
                package_type: "container",
                package_name: `ci-github-container/${process.env.IMAGE_NAME}`,
                org: `${{ github.repository_owner }}`,
                per_page: 100
              }
            );

            const totalCount = versions.length;
            const taggedVersions = versions.filter(version => version.metadata.container.tags.length > 0);
            const untaggedVersions = versions.filter(version => version.metadata.container.tags.length === 0);

            const platforms = JSON.parse(process.env.PLATFORMS);
            const isSinglePlatform = platforms.length === 1;
            const isSigned = process.env.SIGN === 'true';

            // Expected tagged versions:
            // - Always 1 for the main tag
            // - Plus 1 for cosign legacy tag (sha256-...) when signed
            //   Note: ghcr.io doesn't support OCI 1.1 referrers yet, so cosign falls back to legacy attachments
            const expectedTaggedVersions = isSigned ? 2 : 1;

            // Expected untagged versions:
            // - For single platform: 0 (no untagged versions when optimized)
            // - For multi platform: number of platforms (one per platform digest-only push)
            const expectedUntaggedVersions = isSinglePlatform ? 0 : platforms.length;

            assert.equal(
              taggedVersions.length,
              expectedTaggedVersions,
              `Expected ${expectedTaggedVersions} tagged versions, but found ${taggedVersions.length}: ${JSON.stringify(taggedVersions, null, 2)}`
            );
            assert.equal(
              untaggedVersions.length,
              expectedUntaggedVersions,
              `Expected ${expectedUntaggedVersions} untagged versions, but found ${untaggedVersions.length}: ${JSON.stringify(untaggedVersions, null, 2)}`
            );

      - name: Verify image manifest and platforms
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          IMAGE_NAME: "${{ matrix.image-name }}:${{ matrix.tag }}"
          EXPECTED_PLATFORMS: ${{ matrix.platforms }}
        with:
          script: |
            const assert = require("assert");
            const imageName = process.env.IMAGE_NAME;
            const image = `ghcr.io/hoverkraft-tech/ci-github-container/${imageName}`;

            const { exitCode, stdout, stderr } = await exec.getExecOutput('docker', ['manifest', 'inspect', '-v', image]);

            if (exitCode !== 0 || stderr) {
              throw new Error(`Failed to inspect manifest for image: ${image}: ${stderr || stdout}`);
            }

            const manifest = JSON.parse(stdout);

            const expectedPlatforms = JSON.parse(process.env.EXPECTED_PLATFORMS);
            const expectedPlatformCount = expectedPlatforms.length;

            assert.equal(manifest.length, expectedPlatformCount, `Expected ${expectedPlatformCount} platforms, got: ${manifest.length}`);

            expectedPlatforms.forEach(platformStr => {
              const [os, arch] = platformStr.split('/');
              const platformExists = manifest.some(
                platform => (
                  platform?.Descriptor?.platform?.architecture === arch &&
                  platform?.Descriptor?.platform?.os === os
                )
              );

              assert(platformExists, `Expected platform not found: ${platformStr}`);
            });

  assert-images-signature:
    name: Assert - Images signature (${{ matrix.name }})
    needs: [arrange, act-build-images]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.arrange.outputs.matrix) }}
    steps:
      - name: Install cosign
        if: matrix.sign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Verify image signature
        if: matrix.sign
        env:
          SHOULD_HAVE_SIGNATURE: ${{ matrix.sign }}
          IMAGE_NAME: "${{ matrix.image-name }}:${{ matrix.tag }}"
        run: |
          if [ "${SHOULD_HAVE_SIGNATURE}" = "true" ]; then
            echo "Verifying signature for image: ${IMAGE_NAME}"
            cosign verify \
              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
              --certificate-identity-regexp https://github.com/hoverkraft-tech/ci-github-container \
              ghcr.io/hoverkraft-tech/ci-github-container/"${IMAGE_NAME}"

            exit $?
          fi

          echo "Image ${IMAGE_NAME} should not have a signature"
          if cosign verify \
            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
            --certificate-identity-regexp https://github.com/hoverkraft-tech/ci-github-container \
            ghcr.io/hoverkraft-tech/ci-github-container/"${IMAGE_NAME}"; then
            echo "::error::Image ${IMAGE_NAME} should not be signed but signature verification succeeded"
            exit 1
          fi

          echo "Signature verification failed as expected for unsigned image ${IMAGE_NAME}"

  cleanup:
    name: Cleanup ephemeral test packages
    runs-on: ubuntu-latest
    if: always()
    needs:
      - arrange
      - assert-images-versions
      - assert-images-signature
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.arrange.outputs.matrix) }}
    steps:
      - name: Delete ephemeral test packages
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          IMAGE_NAME: ${{ matrix.image-name }}
        run: |
          gh api \
            --method DELETE \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            /orgs/${{ github.repository_owner }}/packages/container/ci-github-container%2F"${IMAGE_NAME}" || echo "No ${IMAGE_NAME} package to delete"

  act-build-args-secrets-and-registry-caching:
    name: Act - Build with args, secrets and registry caching
    needs: arrange
    uses: ./.github/workflows/docker-build-images.yml
    secrets:
      oci-registry-password: ${{ secrets.GITHUB_TOKEN }}
      build-secrets: |
        SECRET_TEST=test-secret
        SECRET_ANOTHER_TEST=another-test-secret
      build-secret-github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
    with:
      cache-type: registry
      images: |
        [
          {
            "name": "test-build-args-secrets",
            "context": ".",
            "target": "test",
            "dockerfile": "./tests/application/Dockerfile",
            "platforms": ["linux/amd64","linux/arm64"],
            "build-args": {
              "BUILD_RUN_ID": "${{ github.run_id }}",
              "BUILD_ARG_TEST": "test-arg",
              "BUILD_ARG_ANOTHER_TEST": "another-test-arg"
            },
            "secret-envs": {
              "SECRET_ENV_TEST": "GITHUB_ACTION",
              "SECRET_ENV_ANOTHER_TEST": "GITHUB_JOB"
            }
          }
        ]
      build-secret-github-app-id: ${{ vars.CI_BOT_APP_ID }}
      build-secret-github-app-token-env: |
        SECRET_ENV_GITHUB_APP_TOKEN_1
        SECRET_ENV_GITHUB_APP_TOKEN_2

  assert-build-args-secrets-and-registry-caching:
    name: Assert - Build with args, secrets and registry caching
    needs: act-build-args-secrets-and-registry-caching
    runs-on: "ubuntu-latest"
    steps:
      - name: Check built images ouput
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const assert = require("assert");

            const builtImagesOutput = `${{ needs.act-build-args-secrets-and-registry-caching.outputs.built-images }}`;
            assert(builtImagesOutput.length, `"built-images" output is empty`);

            // Check if is valid Json
            let builtImages = null;
            try {
              builtImages = JSON.parse(builtImagesOutput);
            } catch (error) {
              throw new Error(`"built-images" output is not a valid JSON: ${error}`);
            }

            const expectedCreatedImages = [
              "test-build-args-secrets"
            ];

            assert(typeof builtImages === "object" && !Array.isArray(builtImages), `"built-images" output is not an object`);
            assert.equal(Object.keys(builtImages).length, expectedCreatedImages.length, `"built-images" output does not contain ${expectedCreatedImages.length} images`);

            for (const image of expectedCreatedImages) {
              assert(builtImages[image], `"built-images" output does not contain "${image}" image`);
            }
      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ github.token }}

      - name: Check docker image and cache
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const assert = require("assert");

            let expectedTag;

            const isPullRequest = `${{ github.event_name }}` === "pull_request";
            if (isPullRequest) {
              const shortSha = `${{ github.sha }}`.substring(0, 7);
              expectedTag = `pr-${{ github.event.pull_request.number }}-${shortSha}`;
            } else {
              expectedTag = `${{ github.ref_name }}`;
            }

            const digest = `${{ fromJson(needs.act-build-args-secrets-and-registry-caching.outputs.built-images).test-build-args-secrets.digest }}`;
            assert(digest.length, `"built-images" output does not contain digest for "test-build-args-secrets" image`);
            assert.match(digest, /^sha256:[0-9a-f]{64}$/, `"built-images" output does not contain valid digest for "test-build-args-secrets" image`);

            const expectedImage = `ghcr.io/hoverkraft-tech/ci-github-container/test-build-args-secrets`;
            const expectedImageTag = `${expectedImage}:${expectedTag}@${digest}`;

            const image = `${{ fromJson(needs.act-build-args-secrets-and-registry-caching.outputs.built-images).test-build-args-secrets.images[0] }}`;

            assert.equal(image, expectedImageTag, `"built-images" output is not valid. Expected "${expectedImage}", got "${image}"`);

            await exec.exec('docker', ['pull', image]);

            let expectedCacheTag;

            if (isPullRequest) {
              expectedCacheTag = `pr-${{ github.event.pull_request.number }}`;
            } else {
              expectedCacheTag = `${{ github.ref_name }}`;
            }

            const cacheImage = `${expectedImage}/cache:${expectedCacheTag}`;

            const cacheImages = [
              `${cacheImage}-linux-arm64`,
              `${cacheImage}-linux-amd64`
            ];

            for (const cacheImage of cacheImages) {
              await exec.exec('docker', ['manifest', 'inspect', cacheImage]);
            }

# jscpd:ignore-end