add test.sh + gate ci behind tests

Author: MarvAmBass

.github/workflows/docker-publish.yml

@@ -21,10 +21,21 @@ env:
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
+  IMAGE_PLATFORMS: linux/amd64,linux/arm64,linux/arm/v7
 
 
 jobs:
+  # gate: don't build or publish anything unless the tests pass
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Run tests
+        run: ./test.sh
+
   build:
+    needs: test
 
     runs-on: ubuntu-latest
     permissions:
@@ -36,20 +47,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3.5.0
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          platforms: ${{ env.IMAGE_PLATFORMS }}
+
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -59,12 +75,16 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Extract Docker Version Tag
-        id: docker_version_tag          
+        id: docker_version_tag
+        env:
+          # rebuild on code changes (push / manual run); only the nightly
+          # schedule dedups on the version tag to skip identical rebuilds
+          FORCE_REBUILD: ${{ github.event_name != 'schedule' && '1' || '' }}
         run: |
           ./get-version.sh $(echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:" | tr '[:upper:]' '[:lower:]') | sed 's/^/tag=/g' >> $GITHUB_OUTPUT
 
@@ -77,12 +97,12 @@ jobs:
       - name: Build and push Docker image with tag
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
         id: build-and-push-tagged
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_version_tag.outputs.tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: ${{ env.IMAGE_PLATFORMS }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -100,7 +120,7 @@ jobs:
 
       - name: Build Docker Latest Tag
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
-        id: docker_latest_tag          
+        id: docker_latest_tag
         run: |
           echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" | tr '[:upper:]' '[:lower:]' >> $GITHUB_OUTPUT
 
@@ -109,12 +129,12 @@ jobs:
       - name: Build and push Docker image as latest
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
         id: build-and-push-latest
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_latest_tag.outputs.tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: ${{ env.IMAGE_PLATFORMS }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/test.yml

@@ -0,0 +1,15 @@
+name: Test
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Run smoke tests
+        run: ./test.sh

get-version.sh

@@ -6,6 +6,14 @@ export DIRVISH_VERSION=$(docker run --rm -t "$IMG" dpkg --list dirvish | grep '^
 [ -z "$DEBIAN_VERSION" ] && exit 1
 
 export IMGTAG=$(echo "$1""d$DEBIAN_VERSION-dv$DIRVISH_VERSION-cv0.0.3")
+# FORCE_REBUILD (set by the workflow for push / manual runs) rebuilds even if
+# the versioned image already exists, so code/config changes get republished.
+# the nightly schedule leaves it unset and keeps deduping on the version tag.
+if [ -n "$FORCE_REBUILD" ]; then
+  echo "$IMGTAG"
+  exit 0
+fi
+
 export IMAGE_EXISTS=$(docker pull "$IMGTAG" 2>/dev/null >/dev/null; echo $?)
 
 # return latest, if container is already available :)

test.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+# Automated smoke test for the dirvish container.
+# dirvish is a backup scheduler (not a network server), so the meaningful
+# check is: the container comes up, the runit-managed services (cron +
+# postfix) are running, and dirvish itself is functional (parses a master.conf
+# and reports its version).
+set -e
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+IMG=dirvish-test
+CN=dirvish-test-run
+
+cleanup() { docker rm -f "$CN" >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+fail() { echo "FAIL: $1"; exit 1; }
+
+echo ">> building image"
+docker build -t "$IMG" "$SCRIPT_DIR"
+
+echo ">> starting container"
+docker rm -f "$CN" >/dev/null 2>&1 || true
+# mount the repo's dirvish config so entrypoint drops a master.conf into
+# /etc/dirvish (dirvish needs one even to answer --version)
+docker run -d --name "$CN" -v "$SCRIPT_DIR/config/dirvish:/config:ro" "$IMG" >/dev/null
+
+echo ">> waiting for runit services to come up (up to 60s)"
+up=0
+for _ in $(seq 1 30); do
+  if docker exec "$CN" sv status /container/config/runit/cron 2>/dev/null | grep -q '^run:' \
+  && docker exec "$CN" sv status /container/config/runit/postfix 2>/dev/null | grep -q '^run:' \
+  && docker exec "$CN" sh -c "ps aux | grep -q '[s]bin/master'" 2>/dev/null; then
+    up=1; break
+  fi
+  sleep 2
+done
+[ "$up" = 1 ] || fail "runit services did not reach 'run' state in time"
+
+echo ">> assert: container is running"
+[ "$(docker inspect -f '{{.State.Running}}' "$CN")" = true ] || fail "container not running"
+echo "ok - container running"
+
+echo ">> assert: runsvdir is PID 1"
+docker exec "$CN" sh -c "ps -o comm= -p 1 | grep -q runsvdir" || fail "runsvdir is not PID 1"
+echo "ok - runsvdir supervising"
+
+echo ">> assert: runit reports cron service running"
+docker exec "$CN" sv status /container/config/runit/cron | grep -q '^run:' || fail "cron service not running"
+echo "ok - cron service up"
+
+echo ">> assert: runit reports postfix service running"
+docker exec "$CN" sv status /container/config/runit/postfix | grep -q '^run:' || fail "postfix service not running"
+echo "ok - postfix service up"
+
+echo ">> assert: cron process present"
+docker exec "$CN" sh -c "ps aux | grep -q '[/]usr/sbin/cron'" || fail "cron process not running"
+echo "ok - cron running"
+
+echo ">> assert: postfix master process present"
+docker exec "$CN" sh -c "ps aux | grep -q '[s]bin/master'" || fail "postfix master not running"
+echo "ok - postfix master running"
+
+echo ">> assert: dirvish parses master.conf and reports its version"
+ver=$(docker exec "$CN" dirvish --version 2>&1) || fail "dirvish --version exited non-zero (got: $ver)"
+echo "$ver" | grep -qi 'dirvish version' || fail "dirvish did not report a version (got: $ver)"
+echo "ok - dirvish version: $(echo "$ver" | tr -d '\r' | head -1)"
+
+echo ""
+echo "ALL TESTS PASSED"