fix(ci): load pinned dependency digests into kind

Author: mahmut-Abi

scripts/ci/ci_assets_test.go

@@ -179,6 +179,21 @@ func TestKindDependencyImageHelperPinsDigestReferences(t *testing.T) {
 	}
 }
 
+func TestKindDependencyImageHelperExposesLocalRuntimeTags(t *testing.T) {
+	contents := string(readFile(t, repoPath("scripts", "ci", "dependency-images.sh")))
+
+	for _, want := range []string{
+		`kind_runtime_image_ref()`,
+		`DEFAULT_KIND_DATAPLANE_IMAGE="$(kind_runtime_image_ref "$DEFAULT_DATAPLANE_IMAGE")"`,
+		`DEFAULT_KIND_DASHBOARD_IMAGE="$(kind_runtime_image_ref "$DEFAULT_DASHBOARD_IMAGE")"`,
+		`:kind-`,
+	} {
+		if !strings.Contains(contents, want) {
+			t.Fatalf("dependency image helper missing %q", want)
+		}
+	}
+}
+
 func TestKindValidationEntrypointsResolvePinnedDependencyImages(t *testing.T) {
 	for _, path := range []string{
 		repoPath("scripts", "ci", "load-kind-images.sh"),
@@ -211,6 +226,34 @@ func TestKindValidationEntrypointsResolvePinnedDependencyImages(t *testing.T) {
 	}
 }
 
+func TestKindLoadHelpersResolveLocalRuntimeTags(t *testing.T) {
+	loadContents := string(readFile(t, repoPath("scripts", "ci", "load-kind-images.sh")))
+	for _, want := range []string{
+		`KIND_DATAPLANE_IMAGE="${KIND_DATAPLANE_IMAGE:-$(kind_runtime_image_ref "$DATAPLANE_IMAGE")}"`,
+		`KIND_DASHBOARD_IMAGE="${KIND_DASHBOARD_IMAGE:-$(kind_runtime_image_ref "$DASHBOARD_IMAGE")}"`,
+		`docker tag "$dataplane_image_id" "$KIND_DATAPLANE_IMAGE"`,
+		`docker tag "$dashboard_image_id" "$KIND_DASHBOARD_IMAGE"`,
+		`kind load docker-image "$KIND_DATAPLANE_IMAGE" --name "$CLUSTER_NAME"`,
+		`kind load docker-image "$KIND_DASHBOARD_IMAGE" --name "$CLUSTER_NAME"`,
+	} {
+		if !strings.Contains(loadContents, want) {
+			t.Fatalf("load-kind-images.sh missing %q", want)
+		}
+	}
+
+	deployContents := string(readFile(t, repoPath("scripts", "ci", "deploy-kind-conformance.sh")))
+	for _, want := range []string{
+		`KIND_DATAPLANE_IMAGE="${KIND_DATAPLANE_IMAGE:-$(kind_runtime_image_ref "$DATAPLANE_IMAGE")}"`,
+		`KIND_DASHBOARD_IMAGE="${KIND_DASHBOARD_IMAGE:-$(kind_runtime_image_ref "$DASHBOARD_IMAGE")}"`,
+		`kustomize edit set image "nantian-dataplane=$KIND_DATAPLANE_IMAGE"`,
+		`kustomize edit set image "nantian-gw-dashboard=$KIND_DASHBOARD_IMAGE"`,
+	} {
+		if !strings.Contains(deployContents, want) {
+			t.Fatalf("deploy-kind-conformance.sh missing %q", want)
+		}
+	}
+}
+
 func TestReleaseWorkflowUsesCurrentCIEntrypoints(t *testing.T) {
 	contents := string(readFile(t, repoPath(".github", "workflows", "release.yml")))
 

scripts/ci/dependency-images.sh

@@ -4,3 +4,37 @@
 # These digests currently back the shared v2026.06.0-rc1 dependency release.
 DEFAULT_DATAPLANE_IMAGE="ghcr.io/nantian-gw/dataplane@sha256:162a5c1b2166653b79684eb8ce25b0063c5d959d95e94e608f13eb04855c605f"
 DEFAULT_DASHBOARD_IMAGE="ghcr.io/nantian-gw/dashboard@sha256:f913109dd5c964a48877de15797e1a2e9f08008e978c5ede53fc2ca9be8c601a"
+
+sanitize_kind_tag_part() {
+  local raw="${1:?tag component is required}"
+
+  raw="${raw//\//-}"
+  raw="${raw//:/-}"
+  raw="${raw//[^[:alnum:]_.-]/-}"
+
+  printf '%s' "$raw"
+}
+
+kind_runtime_image_ref() {
+  local image_ref="${1:?image reference is required}"
+  local repository
+  local suffix
+
+  if [[ "$image_ref" == *"@sha256:"* ]]; then
+    repository="${image_ref%@sha256:*}"
+    suffix="${image_ref##*@sha256:}"
+    suffix="${suffix:0:12}"
+  else
+    repository="${image_ref%:*}"
+    if [[ "$repository" == "$image_ref" ]]; then
+      echo "image reference must include a tag or digest: $image_ref" >&2
+      return 1
+    fi
+    suffix="$(sanitize_kind_tag_part "${image_ref##*:}")"
+  fi
+
+  printf '%s:kind-%s\n' "$repository" "$suffix"
+}
+
+DEFAULT_KIND_DATAPLANE_IMAGE="$(kind_runtime_image_ref "$DEFAULT_DATAPLANE_IMAGE")"
+DEFAULT_KIND_DASHBOARD_IMAGE="$(kind_runtime_image_ref "$DEFAULT_DASHBOARD_IMAGE")"

scripts/ci/deploy-kind-conformance.sh

@@ -8,6 +8,8 @@ source "$SCRIPT_DIR/dependency-images.sh"
 CONTROLPLANE_IMAGE="${CONTROLPLANE_IMAGE:?CONTROLPLANE_IMAGE is required}"
 DATAPLANE_IMAGE="${DATAPLANE_IMAGE:-$DEFAULT_DATAPLANE_IMAGE}"
 DASHBOARD_IMAGE="${DASHBOARD_IMAGE:-$DEFAULT_DASHBOARD_IMAGE}"
+KIND_DATAPLANE_IMAGE="${KIND_DATAPLANE_IMAGE:-$(kind_runtime_image_ref "$DATAPLANE_IMAGE")}"
+KIND_DASHBOARD_IMAGE="${KIND_DASHBOARD_IMAGE:-$(kind_runtime_image_ref "$DASHBOARD_IMAGE")}"
 CONFORMANCE_EXPERIMENTAL="${CONFORMANCE_EXPERIMENTAL:-${ALL_FEATURES:-false}}"
 TIMEOUT="${TIMEOUT:-300s}"
 
@@ -34,8 +36,8 @@ rendered="$tmpdir/kind-conformance.yaml"
 (
   cd "$overlay"
   kustomize edit set image "nantian-controlplane=$CONTROLPLANE_IMAGE"
-  kustomize edit set image "nantian-dataplane=$DATAPLANE_IMAGE"
-  kustomize edit set image "nantian-gw-dashboard=$DASHBOARD_IMAGE"
+  kustomize edit set image "nantian-dataplane=$KIND_DATAPLANE_IMAGE"
+  kustomize edit set image "nantian-gw-dashboard=$KIND_DASHBOARD_IMAGE"
 )
 
 if [[ "$CONFORMANCE_EXPERIMENTAL" == "true" ]]; then
@@ -58,10 +60,16 @@ if [[ "$CONFORMANCE_EXPERIMENTAL" == "true" ]]; then
 fi
 
 kustomize build "$overlay" --load-restrictor LoadRestrictionsNone >"$rendered"
-if ! grep -F "image: $CONTROLPLANE_IMAGE" "$rendered" >/dev/null; then
-  echo "rendered manifests do not use expected control-plane image: $CONTROLPLANE_IMAGE" >&2
-  exit 1
-fi
+
+for expected in \
+  "image: $CONTROLPLANE_IMAGE" \
+  "image: $KIND_DATAPLANE_IMAGE" \
+  "image: $KIND_DASHBOARD_IMAGE"; do
+  if ! grep -F "$expected" "$rendered" >/dev/null; then
+    echo "rendered manifests do not use expected image: $expected" >&2
+    exit 1
+  fi
+done
 
 kubectl apply -f "$rendered"
 kubectl wait --for=condition=ready pod --all -n nantian-gw --timeout="$TIMEOUT"

scripts/ci/load-kind-images.sh

@@ -9,15 +9,34 @@ CLUSTER_NAME="${CLUSTER_NAME:?CLUSTER_NAME is required}"
 CONTROLPLANE_IMAGE="${CONTROLPLANE_IMAGE:?CONTROLPLANE_IMAGE is required}"
 DATAPLANE_IMAGE="${DATAPLANE_IMAGE:-$DEFAULT_DATAPLANE_IMAGE}"
 DASHBOARD_IMAGE="${DASHBOARD_IMAGE:-$DEFAULT_DASHBOARD_IMAGE}"
+KIND_DATAPLANE_IMAGE="${KIND_DATAPLANE_IMAGE:-$(kind_runtime_image_ref "$DATAPLANE_IMAGE")}"
+KIND_DASHBOARD_IMAGE="${KIND_DASHBOARD_IMAGE:-$(kind_runtime_image_ref "$DASHBOARD_IMAGE")}"
 
 docker pull "$DATAPLANE_IMAGE"
 docker pull "$DASHBOARD_IMAGE"
 
+dataplane_image_id="$(docker image inspect --format '{{.Id}}' "$DATAPLANE_IMAGE")"
+dashboard_image_id="$(docker image inspect --format '{{.Id}}' "$DASHBOARD_IMAGE")"
+
+# kind does not preserve digest-only refs as runnable names inside the node, so
+# retag pinned content to deterministic local refs before loading it.
+docker tag "$dataplane_image_id" "$KIND_DATAPLANE_IMAGE"
+docker tag "$dashboard_image_id" "$KIND_DASHBOARD_IMAGE"
+
 kind load docker-image "$CONTROLPLANE_IMAGE" --name "$CLUSTER_NAME"
-kind load docker-image "$DATAPLANE_IMAGE" --name "$CLUSTER_NAME"
-kind load docker-image "$DASHBOARD_IMAGE" --name "$CLUSTER_NAME"
+kind load docker-image "$KIND_DATAPLANE_IMAGE" --name "$CLUSTER_NAME"
+kind load docker-image "$KIND_DASHBOARD_IMAGE" --name "$CLUSTER_NAME"
+
+if [[ -n "${GITHUB_ENV:-}" ]]; then
+  {
+    echo "KIND_DATAPLANE_IMAGE=$KIND_DATAPLANE_IMAGE"
+    echo "KIND_DASHBOARD_IMAGE=$KIND_DASHBOARD_IMAGE"
+  } >>"$GITHUB_ENV"
+fi
 
 echo "Loaded images into kind cluster $CLUSTER_NAME:"
 echo "  controlplane: $CONTROLPLANE_IMAGE"
-echo "  dataplane:    $DATAPLANE_IMAGE"
-echo "  dashboard:    $DASHBOARD_IMAGE"
+echo "  dataplane source:  $DATAPLANE_IMAGE"
+echo "  dataplane kind:    $KIND_DATAPLANE_IMAGE"
+echo "  dashboard source:  $DASHBOARD_IMAGE"
+echo "  dashboard kind:    $KIND_DASHBOARD_IMAGE"