ci.yml

name: 'oci-image'
on:
  push:

jobs:
  docker-buildx:
    runs-on: ubuntu-24.04
    services:
      registry:
        image: registry:2
        ports:
          - 80:5000
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: auth-proxy
            file: imags/git-auth-proxy/Dockerfile
            context: imags/git-auth-proxy
            tags: localhost/l7/auth-proxy:latest
          - name: container-socket-proxy
            context: imags/container-socket-proxy
            file: imags/container-socket-proxy/Dockerfile
            tags: localhost/l7/container-socket-proxy:latest
          - name: dnsmasq
            file: imags/dnsmasq/Containerfile
            context: imags/dnsmasq
            tags: localhost/l7/dnsmasq:latest
          - name: gpg-vault
            file: imags/gpg-vault-pk/Containerfile
            context: .
            tags: localhost/l7/gpg-vault:latest
          - name: node
            file: imags/node-runner/Containerfile
            context: .
            tags: |
              localhost/l7/node:latest
              localhost/l7/node:20-bookworm
          - name: nvim
            file: imags/nvim/Containerfile
            context: .
            tags: |
              localhost/l7/nvim:latest
              localhost/l7/dev-shell:latest
              localhost/l7/dev-shell:nvim
            build-args: |
              BASE_IMAGE=localhost/l7/podman-remote:latest
    steps:
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Allow cleartext http to localhost container registry (docker)
        run: |
          echo '{"insecure-registries" : [ "localhost" ]}' | sudo tee /etc/docker/daemon.json
      - name: Allow cleartext http to localhost container registry (podman)
        run: |
          mkdir -p ~/.config/containers/registries.conf.d
          echo "[[registry]]
            location = 'localhost:80'
          insecure = true" | tee ~/.config/containers/registries.conf.d/insecure-localhost.conf
          systemctl --user restart podman

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: network=host

      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Build and load caddy image
        if: ${{ matrix.name == 'nvim' || matrix.name == 'node' }}
        uses: docker/build-push-action@v6
        with:
          context: imags/caddy
          file: imags/caddy/Containerfile
          tags: localhost/l7/caddy:latest
          load: true
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and load base image
        if: ${{ matrix.name == 'nvim' || matrix.name == 'node' }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: imags/alpine/Containerfile
          tags: localhost/l7/alpine:3.20
          build-args: |
            ALPINE_VERSION=3.20
          load: true
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and load podman-remote image
        if: ${{ matrix.name == 'nvim' || matrix.name == 'node' }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: imags/alpine/Containerfile
          tags: localhost/l7/podman-remote:latest
          build-args: |
            BASE_IMAGE=localhost/l7/alpine:3.20
          load: true
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and load ${{ matrix.name }} image
        uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.file }}
          build-args: ${{ matrix.build-args }}
          tags:  ${{ matrix.tags }}
          load: true
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

  test-make-all:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        cmd:
          - podman
        os:
          - ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: Allow cleartext http to localhost container registry (podman)
        run: |
          mkdir -p ~/.config/containers/registries.conf.d
          echo "[[registry]]
            location = 'localhost:80'
          insecure = true" | tee ~/.config/containers/registries.conf.d/insecure-localhost.conf
          systemctl --user restart podman
      - name: Make all images
        run: |
          make images_deps
          make -j6 images_test
    env:
      CMD: ${{ matrix.cmd }}
      CONTAINER_CMD: ${{ matrix.cmd }}

  test-make:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        image:
          - acng
          - auth_proxy
          - container_proxy
          - caddy
          - dnsmasq
          - gpg_pk
          - nvim
          - runner_node
        cmd:
          #- docker
          - podman
        os:
          #- ubuntu-20.04
          #- ubuntu-22.04
          - ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: Setup podman
        run: |
          mkdir -p ~/.config/containers/registries.conf.d
          echo "[[registry]]
            location = 'localhost:80'
          insecure = true" | tee ~/.config/containers/registries.conf.d/insecure-localhost.conf
          systemctl --user restart podman.socket
          podman info
      - name: Prep
        run: sudo apt-get install -y whois --no-install-recommends

      - name: Make deps
        if: ${{ matrix.image == 'nvim' || matrix.image == 'runner_node' }}
        run: make CMD=${{ matrix.cmd }} image_caddy
      - run: make -j4 CMD=${{ matrix.cmd }} image_${{ matrix.image }}
      - run: make CMD=${{ matrix.cmd }} inspect_${{ matrix.image }}
      - run: make -j4 CMD=${{ matrix.cmd }} test_${{ matrix.image }}
      - name: Extra tests
        if: ${{ matrix.image == 'nvim' && matrix.os == 'ubuntu-24.04' }}
        run: |
          make -j6 CMD=${{ matrix.cmd }} images
          make -j4 CMD=${{ matrix.cmd }} test_extra_${{ matrix.image }}
    env:
      CMD: ${{ matrix.cmd }}
      CONTAINER_CMD: ${{ matrix.cmd }}
      L7_DISABLE_SELINUX: '1'

  test-compose:
    runs-on: ${{ matrix.os }}
    services:
      registry:
        image: registry:2
        ports:
          - 80:5000
    strategy:
      fail-fast: false
      matrix:
        test:
          - test_compose_run
        os:
          - ubuntu-24.04
    steps:
      - name: Setup podman
        run: |
          mkdir -p ~/.config/containers/registries.conf.d
          echo "[[registry]]
            location = 'localhost:80'
          insecure = true" | tee ~/.config/containers/registries.conf.d/insecure-localhost.conf
          systemctl --user restart podman.socket
          podman info
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: Prep
        run: |
          sudo apt-get install -y whois --no-install-recommends
          make -j4 image_alpine
      - run: make -j4 ${{ matrix.test }}
    env:
      DEBUG: ''
      L7_DISABLE_SELINUX: '1'

  test-e2e-podman:
    runs-on: ubuntu-${{ matrix.ubuntu-version }}
    services:
      registry:
        image: registry:2
        ports:
          - 80:5000
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        test:
          - curl
          - ghauth
          - node_corepack
          - lsp_typescript
          - node_majors
        ubuntu-version:
          - 24.04
    steps:
      - name: Setup podman
        run: |
          mkdir -p ~/.config/containers/registries.conf.d
          echo "[[registry]]
            location = 'localhost:80'
          insecure = true" | tee ~/.config/containers/registries.conf.d/insecure-localhost.conf
          systemctl --user restart podman.socket
          podman info
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: set up user config
        run: |
          sudo chown -R $(id -u):$(id -g) "${HOME}"
          sudo apt install -y whois
          usertokenhash="$(mkpasswd -m sha512crypt 'e2e-test-token')"
          echo 'GITHUB_TOKEN=e2e-test-token' > env
          echo 'GH_TOKEN=e2e-test-token' >> env
          echo "export L7_USER_TOKEN_HASH='${usertokenhash}'" > .env
          echo 'export L7_GITHUB_TOKEN=${{ github.token }}' >> .env
      - name: Build images
        run: |
          make images_deps
          make -j6 image_dev_shell image_runner_node
          make -j6 test_runner_node
        if: ${{ matrix.test == 'node_corepack' }}
      - name: Build images
        run: |
          make image_caddy
          make -j6 image_dev_shell image_runner_node_all
        if: ${{ matrix.test == 'node_majors' }}
      - name: Build images
        run: |
          make images_deps
          make -j6 images
          make -j2 images_test
          make -j2 test_lsp_node
        if: ${{ matrix.test == 'lsp_typescript' }}
      - run: |
          make images_deps
          make -j6 images
        if: ${{ matrix.test == 'ghauth' }}
      - run: |
          make images_deps
          make -j6 images
        if: ${{ matrix.test == 'curl' }}
      - name: Run test ${{ matrix.test }}
        run: |
          podman network ls
          make test_e2e_${{ matrix.test }}
    env:
      DEBUG: ''
      L7_DISABLE_SELINUX: '1'


# TODO: should work
#  test-e2e-docker:
#    runs-on: ubuntu-${{ matrix.ubuntu-version }}
#    needs: test-make-all
#    services:
#      registry:
#        image: registry:2
#        ports:
#          - 80:5000
#    permissions:
#      contents: read
#    strategy:
#      fail-fast: false
#      matrix:
#        test:
#          - curl
#          - ghauth
#        ubuntu-version:
#          - 22.04
#          - 24.04
#    steps:
#      - name: Allow cleartext http to localhost container registry (docker)
#        run: |
#          echo '{"insecure-registries" : [ "localhost" ]}' | sudo tee /etc/docker/daemon.json
#
#      - name: Restore image cache
#        uses: actions/cache/restore@v4
#        with:
#          path: /tmp/ci-images
#          key: 'ci-test-${{ github.sha }}'
#
#      - name: Import cached images
#        run: |
#          set -x
#          ls -la /tmp/ci-images
#          find /tmp/ci-images -type f -name '*.tar' -exec sudo docker load -i '{}' \;
#          sudo docker images
#
#      - uses: actions/checkout@v4
#        with:
#          submodules: true
#
#      - name: set up user config
#        run: |
#          sudo chown -R $(id -u):$(id -g) "${HOME}"
#          sudo apt install -y whois
#          usertokenhash="$(mkpasswd -m sha512crypt 'e2e-test-token')"
#          echo 'GITHUB_TOKEN=e2e-test-token' > env
#          echo "export L7_USER_TOKEN_HASH=${usertokenhash}" > .env
#          echo 'export L7_GITHUB_TOKEN=${{ github.token }}' > .env
#
#      - name: Prep docker
#        run: |
#          sudo apt-get update
#          sudo apt-get dist-upgrade -y
#          sudo apt-get install -y --no-install-recommends docker-compose
#          sudo systemctl restart docker.service
#          sudo -E docker --version
#      - name: Run test ${{ matrix.test }}
#        run: |
#          sudo -E docker network ls
#          make test_e2e_${{ matrix.test }}
#    env:
#      CMD: sudo -E docker
#      CONTAINER_CMD: sudo -E docker
#      DEBUG: '1'