[minor] Bundle application releases and harden images

Author: pennypacker-he

.github/workflows/build.yml

@@ -34,6 +34,9 @@ on:
 
 jobs:
   build:
+    env:
+      # renovate: datasource=docker depName=moby/buildkit
+      BUILDKIT_IMAGE: moby/buildkit:v0.31.0@sha256:a095b3d11ce1a9a05b6064ef515dfca0291ec5bcf2ea8178da8f6461924294e1
     strategy:
       matrix:
         runner: [ubuntu-24.04, ubuntu-24.04-arm]
@@ -138,14 +141,14 @@ jobs:
             done
           }
 
-          retry_with_backoff docker pull moby/buildkit:v0.31.0
+          retry_with_backoff docker pull "${BUILDKIT_IMAGE}"
 
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
         with:
           driver-opts: |
-            image=moby/buildkit:v0.31.0
+            image=${{ env.BUILDKIT_IMAGE }}
             network=host
 
       - id: build

.github/workflows/push.yml

@@ -1,9 +1,17 @@
 name: Build and Push Docker Images
 on:
   push:
-    branches: ["*"]
+    branches: ["**"]
     paths:
+      - ".github/workflows/**"
+      - "ci/**"
+      - "cmd/**"
+      - "go.mod"
+      - "go.sum"
       - "images/**"
+      - "internal/**"
+      - "docker-bake.hcl"
+      - "Makefile"
   workflow_dispatch:
     inputs:
       image:
@@ -35,7 +43,9 @@ jobs:
       - uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6
 
       - name: lint
-        run: shellcheck **/*.sh
+        run: |
+          mapfile -d '' scripts < <(git grep -Ilz -E '^#!.*(ba)?sh')
+          shellcheck "${scripts[@]}"
 
   plan:
     runs-on: ubuntu-24.04
@@ -63,6 +73,8 @@ jobs:
       sitectl_isle_libops_image_tags: ${{ steps.plan.outputs.sitectl_isle_libops_image_tags }}
       sitectl_isle_images: ${{ steps.plan.outputs.sitectl_isle_images }}
       sitectl_create_smoke_matrix: ${{ steps.plan.outputs.sitectl_create_smoke_matrix }}
+      sitectl_repository: ${{ steps.plan.outputs.sitectl_repository }}
+      sitectl_ref: ${{ steps.plan.outputs.sitectl_ref }}
     steps:
       - uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6
         with:
@@ -73,6 +85,9 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Test planner and repository contracts
+        run: go test -count=1 ./...
+
       - id: plan
         name: Plan
         env:
@@ -124,6 +139,9 @@ jobs:
             local create_args="$3"
             local image_tags="$4"
             local images="$5"
+            local local_plugin_repository="${6:-}"
+            local local_plugin_ref="${7:-main}"
+            local local_plugin_path="${8:-}"
             if [ -z "${image_tags// }" ]; then
               return
             fi
@@ -134,31 +152,79 @@ jobs:
                 --arg create_args "$create_args" \
                 --arg image_tags "$image_tags" \
                 --arg images "$images" \
+                --arg local_plugin_repository "$local_plugin_repository" \
+                --arg local_plugin_ref "$local_plugin_ref" \
+                --arg local_plugin_path "$local_plugin_path" \
                 '. + [{
                   "plugin": $plugin,
                   "packages": $packages,
                   "create-args": $create_args,
                   "image-tags": $image_tags,
-                  "images": $images
+                  "images": $images,
+                  "local-plugin-repository": $local_plugin_repository,
+                  "local-plugin-ref": $local_plugin_ref,
+                  "local-plugin-path": $local_plugin_path
                 }]' <<<"$smoke_matrix"
             )"
           }
 
+          coordinated_template_args() {
+            local repository="$1"
+            local branch="${GITHUB_REF_NAME}"
+
+            if [ "${branch}" = "main" ]; then
+              return
+            fi
+            if [[ ! "${branch}" =~ ^[A-Za-z0-9._/-]+$ ]]; then
+              echo "Skipping coordinated template branch with unsafe ref name: ${branch}" >&2
+              return
+            fi
+            if git ls-remote --exit-code --heads "${repository}" "refs/heads/${branch}" >/dev/null 2>&1; then
+              printf '%s' "--template-repo ${repository} --template-branch ${branch}"
+            fi
+          }
+
           sitectl_wp_image_tags="$(planned_tag_assignment wp wp-php84)"
           sitectl_omeka_s_image_tags="$(planned_tag_assignment omeka-s omeka-s-php84)"
           sitectl_omeka_classic_image_tags="$(planned_tag_assignment omeka-classic omeka-classic-php84)"
           sitectl_ojs_image_tags="$(planned_tag_assignment ojs ojs-php84)"
           sitectl_drupal_image_tags="$(planned_tag_assignment drupal drupal-php84)"
           sitectl_isle_libops_image_tags="$(planned_tag_assignment drupal islandora-php84)"
           sitectl_isle_images=""
+          sitectl_wp_create_args="$(coordinated_template_args https://github.com/libops/wp)"
+          sitectl_omeka_s_create_args="$(coordinated_template_args https://github.com/libops/omeka-s)"
+          sitectl_omeka_classic_create_args="$(coordinated_template_args https://github.com/libops/omeka-classic)"
+          sitectl_ojs_create_args="$(coordinated_template_args https://github.com/libops/ojs)"
+          sitectl_drupal_create_args="$(coordinated_template_args https://github.com/libops/drupal)"
+          sitectl_isle_template_args="$(coordinated_template_args https://github.com/libops/isle)"
+          if [ -z "${sitectl_isle_template_args}" ]; then
+            sitectl_isle_template_args="--template-repo https://github.com/libops/isle"
+          fi
+          sitectl_isle_create_args="${sitectl_isle_template_args} --fcrepo off --blazegraph off --isle-file-system-uri private --iiif triplet --iiif-topology disabled --bot-mitigation off"
+          sitectl_repository=""
+          sitectl_ref="main"
+          if [ -n "$(coordinated_template_args https://github.com/libops/sitectl)" ]; then
+            sitectl_repository="libops/sitectl"
+            sitectl_ref="${GITHUB_REF_NAME}"
+          fi
+          sitectl_isle_packages="sitectl sitectl-isle sitectl-drupal"
+          sitectl_isle_plugin_repository=""
+          sitectl_isle_plugin_ref="main"
+          sitectl_isle_plugin_path=""
+          if [ -n "$(coordinated_template_args https://github.com/libops/sitectl-isle)" ]; then
+            sitectl_isle_packages="sitectl sitectl-drupal"
+            sitectl_isle_plugin_repository="libops/sitectl-isle"
+            sitectl_isle_plugin_ref="${GITHUB_REF_NAME}"
+            sitectl_isle_plugin_path="sitectl-isle-source"
+          fi
 
           smoke_matrix='[]'
-          add_smoke_row "wp" "sitectl sitectl-wp" "" "$sitectl_wp_image_tags" ""
-          add_smoke_row "omeka-s" "sitectl sitectl-omeka-s" "" "$sitectl_omeka_s_image_tags" ""
-          add_smoke_row "omeka-classic" "sitectl sitectl-omeka-classic" "" "$sitectl_omeka_classic_image_tags" ""
-          add_smoke_row "ojs" "sitectl sitectl-ojs" "" "$sitectl_ojs_image_tags" ""
-          add_smoke_row "drupal" "sitectl sitectl-drupal" "" "$sitectl_drupal_image_tags" ""
-          add_smoke_row "isle" "sitectl sitectl-isle sitectl-drupal" "--template-repo https://github.com/libops/isle --fcrepo off --blazegraph off --isle-file-system-uri private --iiif triplet --iiif-topology disabled --bot-mitigation off" "$sitectl_isle_libops_image_tags" "$sitectl_isle_images"
+          add_smoke_row "wp" "sitectl sitectl-wp" "$sitectl_wp_create_args" "$sitectl_wp_image_tags" ""
+          add_smoke_row "omeka-s" "sitectl sitectl-omeka-s" "$sitectl_omeka_s_create_args" "$sitectl_omeka_s_image_tags" ""
+          add_smoke_row "omeka-classic" "sitectl sitectl-omeka-classic" "$sitectl_omeka_classic_create_args" "$sitectl_omeka_classic_image_tags" ""
+          add_smoke_row "ojs" "sitectl sitectl-ojs" "$sitectl_ojs_create_args" "$sitectl_ojs_image_tags" ""
+          add_smoke_row "drupal" "sitectl sitectl-drupal" "$sitectl_drupal_create_args" "$sitectl_drupal_image_tags" ""
+          add_smoke_row "isle" "$sitectl_isle_packages" "$sitectl_isle_create_args" "$sitectl_isle_libops_image_tags" "$sitectl_isle_images" "$sitectl_isle_plugin_repository" "$sitectl_isle_plugin_ref" "$sitectl_isle_plugin_path"
 
           {
             echo "sitectl_wp_image_tags=${sitectl_wp_image_tags}"
@@ -169,6 +235,8 @@ jobs:
             echo "sitectl_isle_libops_image_tags=${sitectl_isle_libops_image_tags}"
             echo "sitectl_isle_images=${sitectl_isle_images}"
             echo "sitectl_create_smoke_matrix=${smoke_matrix}"
+            echo "sitectl_repository=${sitectl_repository}"
+            echo "sitectl_ref=${sitectl_ref}"
           } >> "$GITHUB_OUTPUT"
 
       - name: Summary
@@ -375,13 +443,13 @@ jobs:
 
   sitectl-create-smoke-test:
     if: ${{ always() && needs.plan.outputs.sitectl_create_smoke_matrix != '[]' && !cancelled() && !failure() }}
-    needs: [plan, test-level-4]
+    needs: [plan, test-level-0, test-level-1, test-level-2, test-level-3, test-level-4]
     strategy:
       fail-fast: false
       matrix:
         include: ${{ fromJson(needs.plan.outputs.sitectl_create_smoke_matrix) }}
 
-    uses: libops/.github/.github/workflows/sitectl-create-smoke-test.yaml@main
+    uses: libops/.github/.github/workflows/sitectl-create-smoke-test.yaml@e366f7422565ea5ee71c0c626b740e03f2e2ffcd # main
     with:
       plugin: ${{ matrix.plugin }}
       create-definition: default
@@ -391,5 +459,10 @@ jobs:
       image-tags: ${{ matrix.image-tags }}
       images: ${{ matrix.images }}
       packages: ${{ matrix.packages }}
+      local-plugin-repository: ${{ matrix.local-plugin-repository }}
+      local-plugin-ref: ${{ matrix.local-plugin-ref }}
+      local-plugin-path: ${{ matrix.local-plugin-path }}
+      sitectl-repository: ${{ needs.plan.outputs.sitectl_repository }}
+      sitectl-ref: ${{ needs.plan.outputs.sitectl_ref }}
     permissions:
       contents: read

Makefile

@@ -31,9 +31,12 @@ endef
 # Used to include host-platform specific docker compose files.
 OS := $(shell uname -s | tr A-Z a-z)
 
-# Used to determine set TAGS when no explicit value provided,
-# as well as to fetch branch specific remote caches when building.
-BRANCH = $(shell git rev-parse --abbrev-ref HEAD)
+# Used to set TAGS when no explicit value is provided and to fetch branch-specific
+# remote caches. Keep it aligned with the metadata helper's Docker-tag fallback
+# normalization so names such as feature/foo produce valid cache references.
+# Pipe the ref directly into the normalizer so branch text is never re-evaluated
+# as part of a generated shell command.
+BRANCH = $(shell git -c safe.directory='$(CURDIR)' rev-parse --abbrev-ref HEAD | sed -E 's/[^A-Za-z0-9_.-]+/-/g; s/^-+//; s/-+$$//')
 
 # The buildkit builder to use.
 BUILDER ?= default
@@ -121,7 +124,7 @@ docker-buildx: | docker
 .SILENT: build/bake.json
 build/bake.json: | docker-buildx jq build folder-permissions executable-permissons
 	set -x; \
-	BRANCH=$(BRANCH) \
+		BRANCH="$(BRANCH)" \
 	CACHE_FROM_REPOSITORY=$(CACHE_FROM_REPOSITORY) \
 	CACHE_TO_REPOSITORY=$(CACHE_TO_REPOSITORY) \
 	REPOSITORY=$(REPOSITORY) \

README.md

@@ -32,9 +32,26 @@ Changes in this fork:
 - Dropped fcrepo file persistence
 - Added ArchivesSpace, OJS, Omeka, and Wordpress images.
   - Moved Islandora buildkit's `drupal` image to `islandora` and made a drupal-only image
-  - All of these images are intended to be infra scaffolding and app-specific codebase dropped into the container in local builds
+  - ArchivesSpace, OJS, Omeka S, and Omeka Classic include checksum-verified upstream application releases.
+  - Drupal and Wordpress remain infrastructure scaffolding for Composer-managed application code in downstream builds.
 - Tags are based on software versions
 - Multiple versions of the same software/image can coexist (e.g. java, solr, fcrepo, php, etc.)
 - `base`  environment variables (e.g. `DB_NAME`) are overriden instead of `IMAGE_NAME_*` env vars
 - Removed Islandora multisite support
 - Added optional Vault-backed secret bootstrap
+
+## OJS dataset initialization
+
+Fresh OJS installations defer the install-time ROR registry and IP geolocation
+downloads so that container initialization is bounded and does not require
+outbound network access. OJS's built-in scheduler remains enabled and updates
+the ROR registry monthly on the first day of the month and the IP database
+monthly on the tenth.
+
+To populate either dataset immediately after installation, run the corresponding
+OJS scheduler task from `/var/www/ojs` as the application user:
+
+```sh
+php lib/pkp/tools/scheduler.php test --name='PKP\task\UpdateRorRegistryDataset'
+php lib/pkp/tools/scheduler.php test --name='PKP\task\UpdateIPGeoDB'
+```

ci/tests/update-sha-readme.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+root_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+work_dir=$(mktemp -d)
+trap 'rm -rf "${work_dir}"' EXIT
+
+# shellcheck disable=SC1090
+UPDATE_SHA_LIBRARY_ONLY=true source "${root_dir}/ci/update-sha.sh" test 1.2.3 2.0.0 ignored
+
+readme="${work_dir}/README.md"
+printf '%s\n' 'Docker image version 1.2.3.' >"${readme}"
+update_readme "${readme}" 1.2.3 2.0.0
+grep -qx 'Docker image version 2.0.0.' "${readme}"
+
+printf '%s\n' 'Docker image version 9.9.9.' >"${readme}"
+if update_readme "${readme}" 1.2.3 2.0.0; then
+  echo "Missing README source version unexpectedly succeeded" >&2
+  exit 1
+fi
+
+printf '%s\n' 'First 1.2.3.' 'Second 1.2.3.' >"${readme}"
+if update_readme "${readme}" 1.2.3 2.0.0; then
+  echo "Ambiguous README source version unexpectedly succeeded" >&2
+  exit 1
+fi