Update CI configuration to use Docker

drslebedev · drslebedev · commit 0916e9c0e7ed · 2026-01-30T08:50:48.000+01:00
* switch to clang-20

Signed-off-by: drslebedev &lt;dr.s.lebedev@gmail.com&gt;
diff --git a/.github/workflows/build_cmake.yml b/.github/workflows/build_cmake.yml
@@ -8,30 +8,44 @@ on:
     types: [ created ]
 
 env:
-  REFERENCE_CONFIG: 'Ubuntu gcc14' # configuration used for coverage etc
+  REFERENCE_CONFIG: 'gcc14' # configuration used for coverage etc
 
 jobs:
+  buildKeycloakDockerImage:
+    uses: ./.github/workflows/build_keycloak_docker.yml
+    permissions:
+      contents: read
+      packages: write
+
   build:
+    needs: buildKeycloakDockerImage
     name: "${{ matrix.configurations.name }} | ${{ matrix.cmake-build-type }}"
     environment: configure coverage
-    runs-on: ${{ matrix.configurations.os }}
+    runs-on: "ubuntu-latest"
+    container: "ghcr.io/fair-acc/gr4-build-container:latest"
     strategy:
       fail-fast: false
       matrix:
         configurations:
-          - name: Ubuntu gcc14
-            os: ubuntu-24.04
+          - name: gcc14
             compiler: gcc14
-          - name: Ubuntu clang18
-            os: ubuntu-24.04
-            compiler: clang18
-          - name: ubuntu-22.04 emscripten
-            os: ubuntu-24.04
+            cc: gcc-14
+            cxx: g++-14
+          - name: clang20
+            compiler: clang20
+            cc: clang-20
+            cxx: clang++-20
+          - name: emscripten
             compiler: emscripten
-        # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
         cmake-build-type: [ Release, Debug ]
     env:
       BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
+    services:
+      keycloak:
+        image: ${{ needs.buildKeycloakDockerImage.outputs.image }}
+        env:
+          KEYCLOAK_ADMIN: admin
+          KEYCLOAK_ADMIN_PASSWORD: admin
 
     steps:
       - uses: actions/checkout@v6
@@ -46,56 +60,26 @@ jobs:
           path: ${{runner.workspace}}/build/_deps
           key: ${{ runner.os }}-${{ matrix.configurations.compiler }}-${{ matrix.cmake-build-type }}-${{ hashFiles('CMakeLists.txt') }}-${{ hashFiles('cmake/Dependencies.cmake') }}
 
-      - name: Install gcovr
-        shell: bash
-        if: matrix.configurations.name == env.REFERENCE_CONFIG && matrix.cmake-build-type == 'Debug'
-        run: sudo apt-get install -y gcovr
-
-      - name: Install gcc-14
-        if: matrix.configurations.compiler == 'gcc14'
-        run: |
-          sudo apt-get install -y gcc-14 g++-14
-          sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-14 110 --slave /usr/bin/g++ g++ /usr/bin/g++-14 --slave /usr/bin/gcov gcov /usr/bin/gcov-14
-
-      - name: Install clang-18
-        if: matrix.configurations.compiler == 'clang18'
-        run: |
-          wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key|sudo apt-key add -
-          sudo apt update
-          sudo apt upgrade -y
-          sudo apt install -y clang-18 libc++-18-dev libc++abi-18-dev
-          sudo update-alternatives --install /usr/bin/cc cc /usr/bin/clang-18 110
-          sudo update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang++-18 110
-
-      - name: Install emscripten
-        if: matrix.configurations.compiler == 'emscripten'
-        run: |
-          cd
-          git clone https://github.com/emscripten-core/emsdk.git
-          cd emsdk
-          # Download and install emscripten.
-          ./emsdk install 3.1.59
-          # Make "active" for the current user. (writes .emscripten file)
-          ./emsdk activate 3.1.59
-
       - name: Install sonar-scanner and build-wrapper
         if: matrix.configurations.name == env.REFERENCE_CONFIG && matrix.cmake-build-type == 'Debug'
         uses: SonarSource/sonarqube-scan-action/install-build-wrapper@v7
 
       - name: Configure CMake
         if: matrix.configurations.compiler != 'emscripten'
-        # Use a bash shell, so we can use the same syntax for environment variable access regardless of the host operating system
         shell: bash
+        env:
+          CC: "${{ matrix.configurations.cc }}"
+          CXX: "${{ matrix.configurations.cxx }}"
+          CMAKE_EXPORT_COMPILE_COMMANDS: "ON"
         run: cmake -S . -B ../build -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_BUILD_TYPE=${{ matrix.cmake-build-type }} -DOPENCMW_ENABLE_COVERAGE=${{ matrix.configurations.name == env.REFERENCE_CONFIG && matrix.cmake-build-type == 'Debug' }}
 
       - name: Configure CMake Emscripten
         if: matrix.configurations.compiler == 'emscripten'
-        # Use a bash shell, so we can use the same syntax for environment variable access regardless of the host operating system
         shell: bash
         run: |
           export SYSTEM_NODE=`which node` # use system node instead of old version distributed with emsdk for threading support
-          source ~/emsdk/emsdk_env.sh
-          emcmake cmake -S . -B ../build -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_BUILD_TYPE=${{ matrix.cmake-build-type }} -DENABLE_TESTING=ON -DCMAKE_CROSSCOMPILING_EMULATOR=${SYSTEM_NODE}
+          source $EMSDK_HOME/emsdk_env.sh
+          emcmake cmake -S . -B ../build -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -DCMAKE_BUILD_TYPE=${{ matrix.cmake-build-type }} -DCMAKE_CROSSCOMPILING_EMULATOR=${SYSTEM_NODE}
 
       - name: Build
         if: matrix.configurations.name != env.REFERENCE_CONFIG || matrix.cmake-build-type != 'Debug'
@@ -107,14 +91,27 @@ jobs:
         shell: bash
         run: build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} cmake --build ../build --config ${{ matrix.cmake-build-type }}
 
-      - name: Run Keycloak Docker
+      - name: Setup Keycloak
+        if: matrix.configurations.compiler != 'emscripten'
         shell: bash
-        run: docker run -p 8090:8080 -d -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:26.0.5 start-dev && src/client/test/setup-keycloak.sh
+        env:
+          KEYCLOAK_URL: http://keycloak:8080
+          KEYCLOAK_REDIRECT_URI: http://localhost:8091
+          KEYCLOAK_ADMIN_PASSWORD: admin
+        run: |
+          if ! command -v jq >/dev/null 2>&1; then
+            sudo apt-get update
+            sudo apt-get install -y --no-install-recommends jq
+          fi
+          src/client/test/setup-keycloak.sh
 
       - name: Run tests
         if: matrix.configurations.name != env.REFERENCE_CONFIG || matrix.cmake-build-type != 'Debug'
         working-directory: ${{runner.workspace}}/build
         shell: bash
+        env:
+          KEYCLOAK_URL: http://keycloak:8080
+          KEYCLOAK_REDIRECT_URI: http://localhost:8091
         # Execute tests defined by the CMake configuration. The coverage target runs the autodiscovered catch2 tests using
         # ctest and records the coverage using gcov
         # See https://cmake.org/cmake/help/latest/manual/ctest.1.html for more detail
@@ -124,6 +121,9 @@ jobs:
         if: matrix.configurations.name == env.REFERENCE_CONFIG && matrix.cmake-build-type == 'Debug'
         working-directory: ${{runner.workspace}}/build
         shell: bash
+        env:
+          KEYCLOAK_URL: http://keycloak:8080
+          KEYCLOAK_REDIRECT_URI: http://localhost:8091
         # Execute tests defined by the CMake configuration. The coverage target runs the autodiscovered catch2 tests using
         # ctest and records the coverage using gcov
         # See https://cmake.org/cmake/help/latest/manual/ctest.1.html for more detail
diff --git a/.github/workflows/build_keycloak_docker.yml b/.github/workflows/build_keycloak_docker.yml
@@ -0,0 +1,64 @@
+# This workflow builds and publishes a tiny Keycloak “wrapper” image that defaults to `kc.sh start-dev`.
+# GitHub Actions service containers cannot pass command arguments (like `start-dev`) to the upstream Keycloak image.
+# The image is rebuilt/pushed only when `docker/keycloak/Dockerfile` changes, otherwise CI reuses the existing tag.
+
+name: Build Keycloak Docker Image
+
+on:
+  workflow_call:
+    outputs:
+      image:
+        description: "Keycloak wrapper image tag"
+        value: ${{ jobs.build.outputs.image }}
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      image: ${{ steps.docker-label.outputs.label }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check if Keycloak Dockerfile was modified
+        id: changes
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            docker:
+              - 'docker/keycloak/Dockerfile'
+
+      - name: Set up Docker Label
+        id: docker-label
+        shell: bash
+        run: |
+          if [ ${{ steps.changes.outputs.docker == 'true' && github.event_name != 'push' }} = "true" ]; then
+            echo "label=ghcr.io/fair-acc/keycloak-start-dev:${GITHUB_HEAD_REF/\//-}" >> "$GITHUB_OUTPUT"
+          else
+            echo "label=ghcr.io/fair-acc/keycloak-start-dev:latest" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Docker Buildx
+        if: steps.changes.outputs.docker == 'true'
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        if: steps.changes.outputs.docker == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build & push Keycloak wrapper image
+        if: steps.changes.outputs.docker == 'true'
+        uses: docker/build-push-action@v5
+        with:
+          context: "{{defaultContext}}:docker/keycloak"
+          push: true
+          tags: ${{ steps.docker-label.outputs.label }}
diff --git a/docker/keycloak/Dockerfile b/docker/keycloak/Dockerfile
@@ -0,0 +1,2 @@
+FROM quay.io/keycloak/keycloak:26.0.5
+CMD ["start-dev"]
diff --git a/sonar-project.properties b/sonar-project.properties
@@ -13,4 +13,4 @@ sonar.organization=fair-acc
 
 # exclude benchmark which crashes the Analysis
 # sonar.exclusions=bench/bm_case1.cpp
-sonar.coverageReportPaths=/home/runner/work/opencmw-cpp/build/coverage_sonarcube.xml
+sonar.cfamily.gcovr.reportPaths=/home/runner/work/opencmw-cpp/build/coverage_sonarcube.xml
diff --git a/src/client/test/setup-keycloak.sh b/src/client/test/setup-keycloak.sh
@@ -6,11 +6,11 @@
 #
 # For more information see: https://www.keycloak.org/getting-started/getting-started-docker
 
-URL="http://localhost:8090"
-REDIRECT_URI="http://localhost:8091"
-ADMIN_PASSWORD="admin"
+URL="${KEYCLOAK_URL:-http://localhost:8090}"
+REDIRECT_URI="${KEYCLOAK_REDIRECT_URI:-http://localhost:8091}"
+ADMIN_PASSWORD="${KEYCLOAK_ADMIN_PASSWORD:-admin}"
 
-while ! curl -s "$URL"; do
+while ! curl -s "$URL" >/dev/null; do
     echo "Waiting for $URL to be reachable..."
     sleep 1
 done
diff --git a/src/services/test/OAuthClient_tests.cpp b/src/services/test/OAuthClient_tests.cpp
@@ -90,7 +90,24 @@ bool loginAtUri(const opencmw::URI<opencmw::STRICT> &uri) {
 
 TEST_CASE("Worker test", "[OAuth]") {
     opencmw::majordomo::Broker<> broker{ "/Broker", {} };
-    opencmw::OAuthWorker         oauthWorker{ opencmw::URI("http://localhost:8091"), opencmw::URI("http://localhost:8090/realms/testrealm/protocol/openid-connect/auth"), opencmw::URI("http://localhost:8090/realms/testrealm/protocol/openid-connect/token"), broker };
+
+    auto envOr = [](std::string_view name, std::string_view fallback) -> std::string {
+        std::string key{name}; // ensures null-terminated
+        if (const char* v = std::getenv(key.c_str()); v && *v) {
+            return std::string(v);
+        }
+        return std::string(fallback);
+    };
+
+    const std::string kcBase = envOr("KEYCLOAK_URL", "http://localhost:8090");
+    const std::string redirectBase = envOr("KEYCLOAK_REDIRECT_URI", "http://localhost:8091");
+
+    opencmw::OAuthWorker oauthWorker{
+        opencmw::URI(redirectBase),
+        opencmw::URI(kcBase + "/realms/testrealm/protocol/openid-connect/auth"),
+        opencmw::URI(kcBase + "/realms/testrealm/protocol/openid-connect/token"),
+     broker
+    };
 
     REQUIRE(broker.bind(opencmw::URI<>("mds://127.0.0.1:12345")));
     REQUIRE(broker.bind(opencmw::URI<>("mdp://127.0.0.1:12346")));

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+FROM quay.io/keycloak/keycloak:26.0.5`
	`2`	`+CMD ["start-dev"]`