Merge pull request #605 from posit-dev/update-dgoss-cli-calls

ianpittwood · web-flow · commit faaf75b44b88 · 2026-06-12T11:17:40.000-06:00
Migrate bakery run dgoss to bakery dgoss run
diff --git a/.github/workflows/bakery-build-native.yml b/.github/workflows/bakery-build-native.yml
@@ -315,7 +315,7 @@ jobs:
         run: |
           GOSS_PATH=${GITHUB_WORKSPACE}/tools/goss \
           DGOSS_PATH=${GITHUB_WORKSPACE}/tools/dgoss \
-          bakery run dgoss \
+          bakery dgoss run \
             --image-name "^${IMAGE_NAME}$" \
             --image-version "$IMAGE_VERSION" \
             --image-platform "$IMAGE_PLATFORM" \
diff --git a/.github/workflows/bakery-build-pr.yml b/.github/workflows/bakery-build-pr.yml
@@ -222,7 +222,7 @@ jobs:
         run: |
           GOSS_PATH=${GITHUB_WORKSPACE}/tools/goss \
           DGOSS_PATH=${GITHUB_WORKSPACE}/tools/dgoss \
-          bakery run dgoss \
+          bakery dgoss run \
             --image-name "^${IMAGE_NAME}$" \
             --image-version "$IMAGE_VERSION" \
             --image-platform "$IMAGE_PLATFORM" \
diff --git a/.github/workflows/bakery-build.yml b/.github/workflows/bakery-build.yml
@@ -268,7 +268,7 @@ jobs:
         run: |
           GOSS_PATH=${GITHUB_WORKSPACE}/tools/goss \
           DGOSS_PATH=${GITHUB_WORKSPACE}/tools/dgoss \
-          bakery run dgoss \
+          bakery dgoss run \
             --image-name "^${IMAGE_NAME}$" \
             --image-version "$IMAGE_VERSION" \
             --dev-versions "$DEV_VERSIONS" \
diff --git a/CI.md b/CI.md
@@ -56,7 +56,7 @@ Each has the same set of caller workflows:
 | Caller | Trigger | Calls |
 |---|---|---|
 | `pr.yml` | `pull_request` | `bakery-build-pr.yml` with `cache: false`, because the images exceed the per-layer cache size limit in GHCR and registry caching silently fails. |
-| `waml.yml` (Azure ML), `wgcw.yml` (Google Cloud Workstations) | weekly cron + push to main + dispatch | Hand-rolled matrix → build → test → push pipeline using the [`setup-bakery`](setup-bakery) and [`setup-goss`](setup-goss) composite actions plus direct `bakery build` and `bakery run dgoss` calls. `wgcw.yml` additionally authenticates to Google Cloud Platform (GCP) via OpenID Connect (OIDC) and uses a GCP Artifact Registry (`us-central1-docker.pkg.dev/cloud-workstations-cache`) as its build cache. Each workflow's gating `ci` job calls the [`slack-build-notify`](.github/actions/slack-build-notify) composite action to post build outcomes to Slack. |
+| `waml.yml` (Azure ML), `wgcw.yml` (Google Cloud Workstations) | weekly cron + push to main + dispatch | Hand-rolled matrix → build → test → push pipeline using the [`setup-bakery`](setup-bakery) and [`setup-goss`](setup-goss) composite actions plus direct `bakery build` and `bakery dgoss run` calls. `wgcw.yml` additionally authenticates to Google Cloud Platform (GCP) via OpenID Connect (OIDC) and uses a GCP Artifact Registry (`us-central1-docker.pkg.dev/cloud-workstations-cache`) as its build cache. Each workflow's gating `ci` job calls the [`slack-build-notify`](.github/actions/slack-build-notify) composite action to post build outcomes to Slack. |
 | `release.yml` | `workflow_dispatch` | Hand-rolled version-bump workflow using the [`setup-bakery`](setup-bakery) composite action and direct `bakery update version` / `bakery create version` / `bakery remove version` calls. Does not call `product-release.yml`. |
 
 ## Cron schedule across consumer repos
@@ -146,13 +146,13 @@ flowchart TD
     subgraph build_amd64[Build/Test amd64]
         a_setup[Checkout + bakery + goss + docker + buildx + oras] --> a_login[Login GHCR/DH/ECR]
         a_login --> a_build["bakery build --strategy build<br/>--push to temp registry"]
-        a_build --> a_test["bakery run dgoss"]
+        a_build --> a_test["bakery dgoss run"]
         a_test --> a_meta[Upload metadata artifact]
     end
     subgraph build_arm64[Build/Test arm64]
         r_setup[Checkout + bakery + goss + docker + buildx + oras] --> r_login[Login GHCR/DH/ECR]
         r_login --> r_build["bakery build --strategy build<br/>--push to temp registry"]
-        r_build --> r_test["bakery run dgoss"]
+        r_build --> r_test["bakery dgoss run"]
         r_test --> r_meta[Upload metadata artifact]
     end
     subgraph merge[Merge / Push]
@@ -204,7 +204,7 @@ flowchart TD
     subgraph build[Build / Test / Push]
         b_setup[Checkout + bakery + goss + QEMU + buildx] --> b_login[Login GHCR/DH/ECR]
         b_login --> b_build["bakery build --load --pull"]
-        b_build --> b_test["bakery run dgoss"]
+        b_build --> b_test["bakery dgoss run"]
         b_test --> b_push{"push=true?"}
         b_push -- yes --> b_pushrun["bakery build --push"]
         b_push -- no --> b_skip[skip]
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -98,7 +98,7 @@ This is a monorepo containing multiple projects:
 Run `bakery --help` and `bakery <command> --help` for full command reference.
 Commands have aliases: `build`/`b`, `create`/`c`, `run`/`r`, `update`/`u`, `remove`/`rm`.
 
-Key commands for product repos: `bakery build`, `bakery build --plan`, `bakery run dgoss`,
+Key commands for product repos: `bakery build`, `bakery build --plan`, `bakery dgoss run`,
 `bakery update files`, `bakery create version`, `bakery ci matrix`.
 
 ## Image Templating System
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -73,7 +73,7 @@ shared template change needs to apply retroactively.
 
     ```bash
     bakery build --image-name <name> --image-version <edition>
-    bakery run dgoss --image-name <name> --image-version <edition>
+    bakery dgoss run --image-name <name> --image-version <edition>
     ```
 
 4. Open a pull request (PR) that includes both the template change and the re-rendered version
diff --git a/posit-bakery/README.md b/posit-bakery/README.md
@@ -36,11 +36,11 @@ Full documentation is available at **[posit-dev.github.io/images-shared](https:/
 |:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------------------------------|:-------------------------------------------------------------------|
 | [docker buildx bake](https://github.com/docker/buildx#installing)                                                                                                         | `bakery build --strategy bake`  | Build containers in parallel                                       |
 | [docker](https://github.com/docker/buildx#installing), [podman](https://podman-desktop.io/docs/installation), or [nerdctl](https://github.com/containerd/nerdctl#install) | `bakery build --strategy build` | Build containers in series                                         |
-| [dgoss](https://github.com/goss-org/goss#installation)                                                                                                                    | `bakery run dgoss`              | Test container images for expected content & behavior              |
-| [hadolint](https://github.com/hadolint/hadolint#install)                                                                                                                  | to be implemented               | Lint Dockerfile/Containerfile                                      |
+| [dgoss](https://github.com/goss-org/goss#installation)                                                                                                                    | `bakery dgoss run`              | Test container images for expected content & behavior              |
+| [hadolint](https://github.com/hadolint/hadolint#install)                                                                                                                  | `bakery hadolint run`           | Lint Dockerfile/Containerfile                                      |
 | [openscap](https://static.open-scap.org/)                                                                                                                                 | to be implemented               | Scan container images for secure configuration and vulnerabilities |
-| trivy                                                                                                                                                                      | to be implemented               | Scan container images for vulnerabilities                          |
-| wizcli                                                                                                                                                                     | to be implemented               | Scan container images for vulnerabilities                          |
+| [trivy](https://trivy.dev/docs/latest/getting-started/)                                                                                                                   | to be implemented               | Scan container images for vulnerabilities                          |
+| [wizcli](https://www.wiz.io/lp/wiz-cli)                                                                                                                                   | `bakery wizcli scan`            | Scan container images for vulnerabilities                          |
 
 ## Installation
 
diff --git a/posit-bakery/posit_bakery/cli/run.py b/posit-bakery/posit_bakery/cli/run.py
@@ -137,7 +137,7 @@ def dgoss(
     """Runs dgoss tests against images in the context path
 
     \b
-    DEPRECATED: Use 'bakery dgoss run' instead.
+    DEPRECATED: Use 'bakery dgoss run' instead. This command will be removed in a future release.
 
     \b
     If no options are provided, the command test all images in the project and write test results to the `results/`
@@ -152,11 +152,14 @@ def dgoss(
     `DGOSS_BIN` environment variables if not present in the system PATH.
     """
     warnings.warn(
-        "'bakery run dgoss' is deprecated. Use 'bakery dgoss run' instead.",
+        "'bakery run dgoss' is deprecated and will be removed in a future release. Use 'bakery dgoss run' instead.",
         DeprecationWarning,
         stacklevel=2,
     )
-    stderr_console.print("[yellow]Warning: 'bakery run dgoss' is deprecated. Use 'bakery dgoss run' instead.[/yellow]")
+    stderr_console.print(
+        "[yellow]Warning: 'bakery run dgoss' is deprecated and will be removed in a future release. "
+        "Use 'bakery dgoss run' instead.[/yellow]"
+    )
 
     # Autoselect host architecture platform if not specified.
     image_platform = image_platform or SETTINGS.architecture
diff --git a/posit-bakery/test/cli/test_run_dgoss.py b/posit-bakery/test/cli/test_run_dgoss.py
@@ -60,6 +60,23 @@ def test_normalizes_platform(self, mocked_bakery_run_dgoss, given, expected):
         assert mock_plugin.execute.call_args[1]["platform"] == expected
 
 
+class TestRunDgossDeprecationWarning:
+    """bakery run dgoss must emit a visible deprecation warning that names the
+    preferred command and states the old form will eventually be removed."""
+
+    def test_emits_deprecation_warning(self, mocked_bakery_run_dgoss):
+        result = runner.invoke(
+            app,
+            ["run", "dgoss", "--context", BASIC_CONTEXT],
+            catch_exceptions=False,
+        )
+        assert result.exit_code == 0
+        combined = result.output
+        assert "deprecated" in combined.lower()
+        assert "bakery dgoss run" in combined
+        assert "removed" in combined.lower()
+
+
 class TestRunDgossLatestFlag:
     """The --latest flag is passed through to settings and warns with dev inclusion."""
 
