add functional test + gate/modernize ci

Author: MarvAmBass

.github/workflows/docker-publish.yml

@@ -21,10 +21,21 @@ env:
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
+  IMAGE_PLATFORMS: linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6
 
 
 jobs:
+  # gate: don't build or publish anything unless the tests pass
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Run tests
+        run: ./test.sh
+
   build:
+    needs: test
 
     runs-on: ubuntu-latest
     permissions:
@@ -36,20 +47,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3.5.0
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          platforms: ${{ env.IMAGE_PLATFORMS }}
+
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -59,12 +75,16 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Extract Docker Version Tag
-        id: docker_version_tag          
+        id: docker_version_tag
+        env:
+          # rebuild on code changes (push / manual run); only the nightly
+          # schedule dedups on the version tag to skip identical rebuilds
+          FORCE_REBUILD: ${{ github.event_name != 'schedule' && '1' || '' }}
         run: |
           ./get-version.sh $(echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:" | tr '[:upper:]' '[:lower:]') | sed 's/^/tag=/g' >> $GITHUB_OUTPUT
 
@@ -77,12 +97,12 @@ jobs:
       - name: Build and push Docker image with tag
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
         id: build-and-push-tagged
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_version_tag.outputs.tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6
+          platforms: ${{ env.IMAGE_PLATFORMS }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -100,7 +120,7 @@ jobs:
 
       - name: Build Docker Latest Tag
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
-        id: docker_latest_tag          
+        id: docker_latest_tag
         run: |
           echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" | tr '[:upper:]' '[:lower:]' >> $GITHUB_OUTPUT
 
@@ -109,12 +129,12 @@ jobs:
       - name: Build and push Docker image as latest
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
         id: build-and-push-latest
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_latest_tag.outputs.tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6
+          platforms: ${{ env.IMAGE_PLATFORMS }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/test.yml

@@ -0,0 +1,15 @@
+name: Test
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Run test suite
+        run: ./test.sh

get-version.sh

@@ -6,6 +6,14 @@ export ALPINE_VERSION=$(docker run --rm -t get-version cat /etc/alpine-release |
 [ -z "$ALPINE_VERSION" ] && exit 1
 
 export IMGTAG=$(echo "$1""a$ALPINE_VERSION-r$RADICALE_VERSION")
+# FORCE_REBUILD (set by the workflow for push / manual runs) rebuilds even if
+# the versioned image already exists, so code/config changes get republished.
+# the nightly schedule leaves it unset and keeps deduping on the version tag.
+if [ -n "$FORCE_REBUILD" ]; then
+  echo "$IMGTAG"
+  exit 0
+fi
+
 export IMAGE_EXISTS=$(docker pull "$IMGTAG" 2>/dev/null >/dev/null; echo $?)
 
 # return latest, if container is already available :)

scripts/command.sh

@@ -1,3 +1,3 @@
 #!/bin/sh
 echo ">> start radicale server (:8000)"
-exec su -l -s /bin/sh -c "exec python3 -m radicale -H 0.0.0.0:8000 -D --storage-type multifilesystem --storage-filesystem-folder /data --no-storage-filesystem-locking --storage-hook 'cd /data && git add -A && (git diff --cached --quiet || git commit -m \"Changes by \"%(user)s)'" radicale
+exec su -l -s /bin/sh -c "exec python3 -m radicale -H 0.0.0.0:8000 -D --storage-type multifilesystem --storage-filesystem-folder /data --storage-hook 'cd /data && git add -A && (git diff --cached --quiet || git commit -m \"Changes by \"%(user)s)'" radicale

test.sh

@@ -0,0 +1,123 @@
+#!/bin/sh
+# automated smoke test for the radicale container
+# builds the image, starts it standalone and asserts radicale actually serves
+# CalDAV/CardDAV (real DAV replies, not just an open port)
+set -eu
+
+IMAGE=radicale-test
+NAME=radicale-test-run
+PORT=8000
+
+FAILED=0
+fail() {
+  echo "FAIL: $*" >&2
+  FAILED=1
+}
+
+cleanup() {
+  echo ">> cleanup: removing container $NAME"
+  docker rm -f "$NAME" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT INT TERM
+
+# send a raw HTTP request to radicale (inside the container, via busybox nc)
+# and print the response. usage: http_req <method> [extra header lines...]
+http_req() {
+  _method="$1"
+  docker exec "$NAME" sh -c "printf '$_method / HTTP/1.1\r\nHost: localhost\r\nDepth: 0\r\nContent-Length: 0\r\nConnection: close\r\n\r\n' | nc 127.0.0.1 $PORT" 2>/dev/null || true
+}
+
+echo ">> building image $IMAGE"
+docker build -t "$IMAGE" .
+
+echo ">> (re)starting container $NAME"
+docker rm -f "$NAME" >/dev/null 2>&1 || true
+# minimal env: radicale needs no config to start (anonymous, filesystem storage)
+docker run -d --name "$NAME" "$IMAGE"
+
+echo ">> waiting for radicale to answer on :$PORT (up to ~40s)"
+READY=0
+i=0
+while [ "$i" -lt 20 ]; do
+  if ! docker ps --format '{{.Names}}' | grep -q "^${NAME}$"; then
+    echo "!! container is not running anymore, dumping logs:" >&2
+    docker logs "$NAME" >&2 2>&1 || true
+    fail "container exited during startup"
+    break
+  fi
+  if http_req OPTIONS | grep -q '^HTTP/'; then
+    READY=1
+    break
+  fi
+  i=$((i + 1))
+  sleep 2
+done
+
+if [ "$READY" -ne 1 ] && [ "$FAILED" -eq 0 ]; then
+  echo "!! radicale did not answer in time, dumping logs:" >&2
+  docker logs "$NAME" >&2 2>&1 || true
+  fail "timed out waiting for radicale to respond"
+fi
+
+# only run the deeper assertions if the container is still up
+if docker ps --format '{{.Names}}' | grep -q "^${NAME}$"; then
+
+  echo ">> assert: container is running"
+  docker ps --format '{{.Names}}' | grep -q "^${NAME}$" \
+    && echo "ok - container running" || fail "container not running"
+
+  echo ">> assert: radicale process present"
+  if docker exec "$NAME" ps aux | grep -q '[r]adicale'; then
+    echo "ok - radicale process running"
+  else
+    fail "radicale process not found"
+  fi
+
+  # OPTIONS is the DAV capability probe. a plain port-open check would pass on
+  # anything; here we require the DAV: header advertising calendar-access and
+  # addressbook, which only a CalDAV/CardDAV server (radicale) sends back.
+  echo ">> assert: OPTIONS returns 200 with CalDAV/CardDAV DAV header"
+  OPTIONS_RESP=$(http_req OPTIONS)
+  if echo "$OPTIONS_RESP" | grep -q '^HTTP/1.[01] 200'; then
+    echo "ok - OPTIONS returned 200"
+  else
+    fail "OPTIONS did not return 200 (got: '$(echo "$OPTIONS_RESP" | head -n1)')"
+  fi
+  if echo "$OPTIONS_RESP" | grep -qi '^DAV:.*calendar-access' \
+     && echo "$OPTIONS_RESP" | grep -qi '^DAV:.*addressbook'; then
+    echo "ok - DAV header advertises calendar-access + addressbook"
+  else
+    fail "OPTIONS response missing CalDAV/CardDAV DAV header"
+  fi
+
+  echo ">> assert: Allow header lists DAV methods (PROPFIND, REPORT, MKCALENDAR)"
+  if echo "$OPTIONS_RESP" | grep -qi '^Allow:.*PROPFIND' \
+     && echo "$OPTIONS_RESP" | grep -qi '^Allow:.*REPORT' \
+     && echo "$OPTIONS_RESP" | grep -qi '^Allow:.*MKCALENDAR'; then
+    echo "ok - Allow header lists DAV methods"
+  else
+    fail "OPTIONS Allow header missing DAV methods"
+  fi
+
+  # PROPFIND is a real DAV method; the default config requires auth for it, so
+  # radicale answers with its own Basic realm. this proves it is actually
+  # processing DAV requests (and is radicale), not merely accepting a socket.
+  echo ">> assert: PROPFIND is handled and challenges with the Radicale realm"
+  PROPFIND_RESP=$(http_req PROPFIND)
+  if echo "$PROPFIND_RESP" | grep -q '^HTTP/1.[01] 401' \
+     && echo "$PROPFIND_RESP" | grep -qi 'WWW-Authenticate: Basic realm="Radicale'; then
+    echo "ok - PROPFIND challenged with Radicale Basic realm"
+  else
+    fail "PROPFIND did not return a Radicale auth challenge (got: '$(echo "$PROPFIND_RESP" | head -n1)')"
+  fi
+
+fi
+
+echo
+if [ "$FAILED" -eq 0 ]; then
+  echo "ALL TESTS PASSED"
+  exit 0
+else
+  echo "SOME TESTS FAILED"
+  exit 1
+fi