Archived
austin
73e4b7fbef
The image build runs 'mvn -DskipTests', and the workflow was only build -> Trivy -> push, so no app test has ever run in CI. Only Trivy gated a merge. ContactControllerTest had been broken since platform 0.1.6 and nothing noticed; the platform contract tests added in 0.1.9 were not running either, which defeated their purpose. They cannot run inside 'docker build' — Testcontainers needs a Docker daemon and a build has none. Maven runs as a sibling container instead, mounting the workspace volume act_runner gave this job (discovered from our own container rather than guessed) and sharing the host network so published test ports are reachable as localhost. Fails loudly if the volume cannot be found, rather than quietly skipping the tests, which would recreate exactly the problem this fixes.
76 lines
3.4 KiB
YAML
76 lines
3.4 KiB
YAML
name: build-and-publish
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# Files that can't change the image. Skipping them avoids a pointless rebuild that Watchtower
|
|
# would then redeploy — a few seconds of downtime on a live site for a docs-only commit.
|
|
paths-ignore: ["renovate.json", "**.md"]
|
|
# Lets `rebuild-all-apps.sh` force a rebuild (e.g. to roll out an urgent platform fix immediately
|
|
# instead of waiting for a Renovate bump PR).
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
|
|
# Tests run BEFORE the image is built, and they gate it.
|
|
#
|
|
# They cannot run inside `docker build` — Testcontainers needs a Docker daemon and there is none
|
|
# in a build. So Maven runs as a sibling container instead, mounting the volume act_runner gave
|
|
# this job (discovered from our own container rather than guessed) and sharing the host network so
|
|
# the ports Testcontainers publishes are reachable as localhost.
|
|
- name: Test
|
|
run: |
|
|
set -euo pipefail
|
|
VOL=$(docker inspect "$(hostname)" \
|
|
--format '{{range .Mounts}}{{if eq .Destination "/workspace"}}{{.Name}}{{end}}{{end}}')
|
|
if [ -z "$VOL" ]; then
|
|
echo "could not find this job's workspace volume — refusing to skip the tests" >&2
|
|
exit 1
|
|
fi
|
|
docker run --rm --network host \
|
|
-v "$VOL":/workspace \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-e TESTCONTAINERS_RYUK_DISABLED=true \
|
|
-e MAVEN_USER="${{ secrets.REGISTRY_USER }}" \
|
|
-e MAVEN_TOKEN="${{ secrets.REGISTRY_TOKEN }}" \
|
|
-w "/workspace/${{ github.repository }}" \
|
|
maven:3.9-eclipse-temurin-25 \
|
|
mvn -B -ntp -s .gitea/ci-settings.xml -DskipFrontend=true verify
|
|
|
|
- name: Log in to the Gitea container registry
|
|
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thebennett.net -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
# The platform is now referenced by an immutable RELEASE version, so a cached maven layer can't
|
|
# silently hold an old build — layer caching is safe again (and much faster).
|
|
- name: Build image
|
|
env:
|
|
DOCKER_BUILDKIT: "1"
|
|
MAVEN_USER: ${{ secrets.REGISTRY_USER }}
|
|
MAVEN_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
docker build \
|
|
--secret id=maven_user,env=MAVEN_USER \
|
|
--secret id=maven_token,env=MAVEN_TOKEN \
|
|
--build-arg GIT_SHA=${{ github.sha }} \
|
|
-t git.thebennett.net/thevine/itsthevine:latest \
|
|
-t git.thebennett.net/thevine/itsthevine:${{ github.sha }} .
|
|
|
|
- name: Scan image (Trivy)
|
|
run: |
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
|
aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --no-progress \
|
|
git.thebennett.net/thevine/itsthevine:latest || true
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
|
aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed \
|
|
--pkg-types library --exit-code 1 --no-progress \
|
|
git.thebennett.net/thevine/itsthevine:latest
|
|
|
|
- name: Push image
|
|
run: |
|
|
docker push git.thebennett.net/thevine/itsthevine:latest
|
|
docker push git.thebennett.net/thevine/itsthevine:${{ github.sha }}
|