Skip to content

Commit dc5f6cf

Browse files
mahmut-Abimahmut-Abi
committed
fix(ci): pin kind dependency image digests
1 parent c26d198 commit dc5f6cf

6 files changed

Lines changed: 96 additions & 8 deletions

File tree

‎.github/workflows/conformance.yml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@ env:
1919
CLUSTER_NAME: conformance
2020
GATEWAY_API_VERSION: v1.5.1
2121
CONTROLPLANE_IMAGE: ghcr.io/nantian-gw/nantian-controlplane:ci-${{ github.sha }}
22-
DATAPLANE_IMAGE: ghcr.io/nantian-gw/dataplane:latest
23-
DASHBOARD_IMAGE: ghcr.io/nantian-gw/dashboard:latest
2422

2523
jobs:
2624
gateway-api:
@@ -30,6 +28,14 @@ jobs:
3028
steps:
3129
- uses: actions/checkout@v6
3230

31+
- name: Resolve dependency images
32+
run: |
33+
source scripts/ci/dependency-images.sh
34+
{
35+
echo "DATAPLANE_IMAGE=${DATAPLANE_IMAGE:-$DEFAULT_DATAPLANE_IMAGE}"
36+
echo "DASHBOARD_IMAGE=${DASHBOARD_IMAGE:-$DEFAULT_DASHBOARD_IMAGE}"
37+
} >>"${GITHUB_ENV}"
38+
3339
- uses: actions/setup-go@v6
3440
with:
3541
go-version-file: go.mod
@@ -110,6 +116,14 @@ jobs:
110116
steps:
111117
- uses: actions/checkout@v6
112118

119+
- name: Resolve dependency images
120+
run: |
121+
source scripts/ci/dependency-images.sh
122+
{
123+
echo "DATAPLANE_IMAGE=${DATAPLANE_IMAGE:-$DEFAULT_DATAPLANE_IMAGE}"
124+
echo "DASHBOARD_IMAGE=${DASHBOARD_IMAGE:-$DEFAULT_DASHBOARD_IMAGE}"
125+
} >>"${GITHUB_ENV}"
126+
113127
- uses: actions/setup-go@v6
114128
with:
115129
go-version-file: go.mod

‎.github/workflows/e2e.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@ env:
1818
CLUSTER_NAME: e2e
1919
GATEWAY_API_VERSION: v1.5.1
2020
CONTROLPLANE_IMAGE: ghcr.io/nantian-gw/nantian-controlplane:ci-${{ github.sha }}
21-
DATAPLANE_IMAGE: ghcr.io/nantian-gw/dataplane:latest
22-
DASHBOARD_IMAGE: ghcr.io/nantian-gw/dashboard:latest
2321

2422
jobs:
2523
smoke:
@@ -29,6 +27,14 @@ jobs:
2927
steps:
3028
- uses: actions/checkout@v6
3129

30+
- name: Resolve dependency images
31+
run: |
32+
source scripts/ci/dependency-images.sh
33+
{
34+
echo "DATAPLANE_IMAGE=${DATAPLANE_IMAGE:-$DEFAULT_DATAPLANE_IMAGE}"
35+
echo "DASHBOARD_IMAGE=${DASHBOARD_IMAGE:-$DEFAULT_DASHBOARD_IMAGE}"
36+
} >>"${GITHUB_ENV}"
37+
3238
- name: Install Kind tooling
3339
run: scripts/ci/install-kind-tools.sh
3440

‎scripts/ci/ci_assets_test.go‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,60 @@ func TestWorkflowsUseSharedKindClusterHelper(t *testing.T) {
157157
}
158158
}
159159

160+
func TestKindDependencyImageHelperPinsDigestReferences(t *testing.T) {
161+
contents := string(readFile(t, repoPath("scripts", "ci", "dependency-images.sh")))
162+
163+
for _, want := range []string{
164+
`DEFAULT_DATAPLANE_IMAGE="ghcr.io/nantian-gw/dataplane@sha256:bacc962711a95fd8fa75e3f9206319a42490b6eaf94257d57fc48f998444ea0e"`,
165+
`DEFAULT_DASHBOARD_IMAGE="ghcr.io/nantian-gw/dashboard@sha256:74f4c0f4afbf3f8c0ec26110a31d2327ca45d97d0ebd0ce73a765b051d6c208a"`,
166+
} {
167+
if !strings.Contains(contents, want) {
168+
t.Fatalf("dependency image helper missing %q", want)
169+
}
170+
}
171+
172+
for _, unwanted := range []string{
173+
`ghcr.io/nantian-gw/dataplane:latest`,
174+
`ghcr.io/nantian-gw/dashboard:latest`,
175+
} {
176+
if strings.Contains(contents, unwanted) {
177+
t.Fatalf("dependency image helper must not reference %q", unwanted)
178+
}
179+
}
180+
}
181+
182+
func TestKindValidationEntrypointsResolvePinnedDependencyImages(t *testing.T) {
183+
for _, path := range []string{
184+
repoPath("scripts", "ci", "load-kind-images.sh"),
185+
repoPath("scripts", "ci", "deploy-kind-conformance.sh"),
186+
repoPath(".github", "workflows", "e2e.yml"),
187+
repoPath(".github", "workflows", "conformance.yml"),
188+
} {
189+
t.Run(filepath.Base(path), func(t *testing.T) {
190+
contents := string(readFile(t, path))
191+
192+
for _, want := range []string{
193+
`dependency-images.sh`,
194+
`DEFAULT_DATAPLANE_IMAGE`,
195+
`DEFAULT_DASHBOARD_IMAGE`,
196+
} {
197+
if !strings.Contains(contents, want) {
198+
t.Fatalf("%s missing %q", path, want)
199+
}
200+
}
201+
202+
for _, unwanted := range []string{
203+
`ghcr.io/nantian-gw/dataplane:latest`,
204+
`ghcr.io/nantian-gw/dashboard:latest`,
205+
} {
206+
if strings.Contains(contents, unwanted) {
207+
t.Fatalf("%s still references mutable image %q", path, unwanted)
208+
}
209+
}
210+
})
211+
}
212+
}
213+
160214
func TestReleaseWorkflowUsesCurrentCIEntrypoints(t *testing.T) {
161215
contents := string(readFile(t, repoPath(".github", "workflows", "release.yml")))
162216

‎scripts/ci/dependency-images.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
3+
# Last known-good dependency images for gateway kind validation.
4+
# Update these intentionally after a dependency image has passed gateway E2E.
5+
DEFAULT_DATAPLANE_IMAGE="ghcr.io/nantian-gw/dataplane@sha256:bacc962711a95fd8fa75e3f9206319a42490b6eaf94257d57fc48f998444ea0e"
6+
DEFAULT_DASHBOARD_IMAGE="ghcr.io/nantian-gw/dashboard@sha256:74f4c0f4afbf3f8c0ec26110a31d2327ca45d97d0ebd0ce73a765b051d6c208a"

‎scripts/ci/deploy-kind-conformance.sh‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
#!/usr/bin/env bash
22
set -euo pipefail
33

4+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
5+
# shellcheck source=./dependency-images.sh
6+
source "$SCRIPT_DIR/dependency-images.sh"
7+
48
CONTROLPLANE_IMAGE="${CONTROLPLANE_IMAGE:?CONTROLPLANE_IMAGE is required}"
5-
DATAPLANE_IMAGE="${DATAPLANE_IMAGE:-ghcr.io/nantian-gw/dataplane:latest}"
6-
DASHBOARD_IMAGE="${DASHBOARD_IMAGE:-ghcr.io/nantian-gw/dashboard:latest}"
9+
DATAPLANE_IMAGE="${DATAPLANE_IMAGE:-$DEFAULT_DATAPLANE_IMAGE}"
10+
DASHBOARD_IMAGE="${DASHBOARD_IMAGE:-$DEFAULT_DASHBOARD_IMAGE}"
711
CONFORMANCE_EXPERIMENTAL="${CONFORMANCE_EXPERIMENTAL:-${ALL_FEATURES:-false}}"
812
TIMEOUT="${TIMEOUT:-300s}"
913

‎scripts/ci/load-kind-images.sh‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
11
#!/usr/bin/env bash
22
set -euo pipefail
33

4+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
5+
# shellcheck source=./dependency-images.sh
6+
source "$SCRIPT_DIR/dependency-images.sh"
7+
48
CLUSTER_NAME="${CLUSTER_NAME:?CLUSTER_NAME is required}"
59
CONTROLPLANE_IMAGE="${CONTROLPLANE_IMAGE:?CONTROLPLANE_IMAGE is required}"
6-
DATAPLANE_IMAGE="${DATAPLANE_IMAGE:-ghcr.io/nantian-gw/dataplane:latest}"
7-
DASHBOARD_IMAGE="${DASHBOARD_IMAGE:-ghcr.io/nantian-gw/dashboard:latest}"
10+
DATAPLANE_IMAGE="${DATAPLANE_IMAGE:-$DEFAULT_DATAPLANE_IMAGE}"
11+
DASHBOARD_IMAGE="${DASHBOARD_IMAGE:-$DEFAULT_DASHBOARD_IMAGE}"
812

913
docker pull "$DATAPLANE_IMAGE"
1014
docker pull "$DASHBOARD_IMAGE"

0 commit comments

Comments
 (0)