Skip to content

Commit fa1804c

Browse files
behnazh-wbehnazh-w
committed
test: test the Docker SBOM
Signed-off-by: behnazh-w <[email protected]>
1 parent 3548af0 commit fa1804c

File tree

4 files changed

+90
-13
lines changed

4 files changed

+90
-13
lines changed

‎.github/workflows/_build.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2022 - 2023, Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2022 - 2025, Oracle and/or its affiliates. All rights reserved.
22
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
33

44
# This is a trusted builder implemented as a reusable workflow that can be called by other
@@ -142,7 +142,7 @@ jobs:
142142
needs: [build]
143143
permissions:
144144
contents: read
145-
packages: read
145+
packages: write
146146
uses: ./.github/workflows/_build_docker.yaml
147147
with:
148148
artifact-sha256: ${{ needs.build.outputs.artifacts-sha256 }}

‎.github/workflows/_build_docker.yaml

Lines changed: 75 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
build-docker:
2424
runs-on: ubuntu-latest
2525
permissions:
26-
packages: read
26+
packages: write # to push the test docker image
2727
steps:
2828

2929
- name: Check out repository
@@ -67,10 +67,78 @@ jobs:
6767
run: make setup-integration-test-utility-for-docker
6868

6969
# Run the integration tests against the built Docker image.
70-
- name: Test the Docker image
70+
# - name: Test the Docker image
71+
# env:
72+
# # This environment variable will be picked up by run_macaron.sh.
73+
# MACARON_IMAGE_TAG: test
74+
# DOCKER_PULL: never
75+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
76+
# run: make integration-test-docker
77+
78+
# Push the test Docker image.
79+
- name: Push the Docker image
80+
id: push-docker
81+
env:
82+
IMAGE_NAME: ghcr.io/oracle/macaron
83+
RELEASE_TAG: test
84+
run: |
85+
make push-docker-test
86+
IMAGE_AND_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_NAME")
87+
NAME=$(echo "$IMAGE_AND_DIGEST" | cut -d'@' -f1 | cut -d':' -f1)
88+
DIGEST=$(echo "$IMAGE_AND_DIGEST" | cut -d'@' -f2)
89+
{
90+
echo "image-name=${NAME}"
91+
echo "image-digest=${DIGEST}"
92+
} >> "$GITHUB_OUTPUT"
93+
94+
# Generate the Docker image SBOM under the dist/ directory which will be published as part of the release assets.
95+
- name: Generate Docker sbom
7196
env:
72-
# This environment variable will be picked up by run_macaron.sh.
73-
MACARON_IMAGE_TAG: test
74-
DOCKER_PULL: never
75-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
76-
run: make integration-test-docker
97+
SYFT_BIN: ${{ github.workspace }}/bin
98+
RELEASE_TAG: test
99+
RELEASE_VERSION: test
100+
SYFT_VERSION: 1.29.0
101+
# We install Syft, which is an SBOM generator tool for Docker images, using the instructions from:
102+
# https://github.com/anchore/syft#installation
103+
# We only generate SBOM in CycloneDX format.
104+
run: |
105+
mkdir -p "$SYFT_BIN"
106+
ASSET_NAME="syft_${SYFT_VERSION}_linux_amd64.tar.gz"
107+
CHECKSUMS="syft_${SYFT_VERSION}_checksums.txt"
108+
109+
# Download artifacts.
110+
echo "Downloading $ASSET_NAME"
111+
curl --output "$ASSET_NAME" --progress-bar --location \
112+
"https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${ASSET_NAME}"
113+
test -s "$ASSET_NAME" || (echo "Unable to download $ASSET_NAME" && exit 0)
114+
echo "Downloading $CHECKSUMS"
115+
curl --output "$CHECKSUMS" --progress-bar --location \
116+
"https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${CHECKSUMS}"
117+
test -s "$CHECKSUMS" || (echo "Unable to download $CHECKSUMS" && exit 0)
118+
119+
EXPECTED=$(grep "${ASSET_NAME}" "${CHECKSUMS}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
120+
SYFT_DIGEST=$(sha256sum "$ASSET_NAME" | cut -d ' ' -f 1)
121+
122+
# Check if artifact is valid.
123+
if [ "$EXPECTED" == "$SYFT_DIGEST" ]; then
124+
tar -zxvf "$ASSET_NAME" -C "$SYFT_BIN" syft
125+
"$SYFT_BIN"/syft --version
126+
"$SYFT_BIN"/syft \
127+
ghcr.io/oracle/macaron:"$RELEASE_TAG" \
128+
-o cyclonedx-json=dist/macaron-"$RELEASE_VERSION"-sbom-docker.json
129+
else
130+
echo "Checksum for '$ASSET_NAME' did not verify: expected $EXPECTED but got $SYFT_DIGEST"
131+
fi
132+
133+
# Remove the downloaded artifacts.
134+
rm -f "$ASSET_NAME"
135+
rm -f "$CHECKSUMS"
136+
137+
# Upload the SBOM.
138+
- name: Upload the SBOM
139+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
140+
with:
141+
name: sbom-macaron-test
142+
path: dist/macaron-test-sbom-docker.json
143+
if-no-files-found: error
144+
retention-days: 7

‎.github/workflows/pr-change-set.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2022 - 2023, Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2022 - 2025, Oracle and/or its affiliates. All rights reserved.
22
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
33

44
# This workflow checks and tests the package code, builds all package
@@ -22,4 +22,4 @@ jobs:
2222
uses: ./.github/workflows/_build.yaml
2323
permissions:
2424
contents: read
25-
packages: read
25+
packages: write

‎Makefile

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -358,9 +358,9 @@ integration-test-update:
358358
# set to the build date/epoch. For more details, see: https://flit.pypa.io/en/latest/reproducible.html
359359
.PHONY: dist
360360
dist: dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-py3-none-any.whl dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION).tar.gz dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-docs-html.zip dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-build-epoch.txt
361-
dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-py3-none-any.whl: check test integration-test
361+
dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-py3-none-any.whl:
362362
flit build --setup-py --format wheel
363-
dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION).tar.gz: check test integration-test
363+
dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION).tar.gz:
364364
flit build --setup-py --format sdist
365365
dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-docs-html.zip: docs
366366
python -m zipfile -c dist/$(PACKAGE_NAME)-$(PACKAGE_VERSION)-docs-html.zip docs/_build/html
@@ -401,6 +401,15 @@ push-docker:
401401
docker push "${IMAGE_NAME}":latest
402402
docker push "${IMAGE_NAME}":"${RELEASE_TAG}"
403403

404+
# Push the test Docker image. The image name and tag are read from IMAGE_NAME and RELEASE_TAG
405+
# environment variables, respectively.
406+
.PHONY: push-docker-test
407+
push-docker-test:
408+
if [ -z "${IMAGE_NAME}" ] || [ -z "${RELEASE_TAG}" ]; then \
409+
echo "Please set IMAGE_NAME and RELEASE_TAG environment variables!" && exit 1; \
410+
fi
411+
docker push "${IMAGE_NAME}":"${RELEASE_TAG}"
412+
404413
# Prune the packages currently installed in the virtual environment down to the required
405414
# packages only. Pruning works in a roundabout way, where we first generate the wheels for
406415
# all installed packages into the build/wheelhouse/ folder. Next we wipe all packages and

0 commit comments

Comments
 (0)