improve tests to avoid manually docker push (#481)

Signed-off-by: wbpcode <wbphub@gmail.com>

Author: wbpcode

cli/e2e/create_test.go

@@ -13,8 +13,6 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
-	"strconv"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -77,7 +75,15 @@ func TestCreateGoWithDockerSupport(t *testing.T) {
 			require.NoError(t, err, "Makefile build_image target should be valid")
 
 			manifest := &extensions.Manifest{Name: "test-docker", Version: version, Type: extensions.TypeGo, CShared: true}
-			pushOCIImageForDownload(t, extensionDir, "./Dockerfile", manifest)
+			// Build and push the single-platform image via the Makefile's push_image target, which
+			// emits the manifest-level OCI annotations required by boe download.
+			// #nosec G204
+			pushCmd := exec.CommandContext(ctx, "make", "push_image", "PLATFORMS=linux/"+runtime.GOARCH)
+			pushCmd.Dir = extensionDir
+			pushOutput, err := pushCmd.CombinedOutput()
+			t.Logf("make push_image output: %s", string(pushOutput))
+			require.NoError(t, err, "Makefile push_image target should be valid")
+
 			requireDownloadHasFiles(t, manifest, "manifest.yaml", "config.schema.json")
 		})
 	})
@@ -117,7 +123,15 @@ func TestCreateGoWithDockerSupport(t *testing.T) {
 			require.NoError(t, err, "Makefile build_image_plugin target should be valid")
 
 			manifest := &extensions.Manifest{Name: "test-docker", Version: version, Type: extensions.TypeGo, CShared: false}
-			pushOCIImageForDownload(t, extensionDir, "./Dockerfile.plugin", manifest)
+			// Build and push the single-platform plugin image via the Makefile's push_image_plugin
+			// target, which emits the manifest-level OCI annotations required by boe download.
+			// #nosec G204
+			pushCmd := exec.CommandContext(ctx, "make", "push_image_plugin", "PLATFORMS=linux/"+runtime.GOARCH)
+			pushCmd.Dir = extensionDir
+			pushOutput, err := pushCmd.CombinedOutput()
+			t.Logf("make push_image_plugin output: %s", string(pushOutput))
+			require.NoError(t, err, "Makefile push_image_plugin target should be valid")
+
 			requireDownloadHasFiles(t, manifest, "manifest.yaml", "config.schema.json")
 		})
 	})
@@ -178,63 +192,20 @@ func TestCreateRustNetworkAndListenerFilters(t *testing.T) {
 			t.Logf("make build_image output: %s", string(output))
 			require.NoError(t, err, "Makefile build_image target should be valid")
 
-			// Push local image to registry and check its annotations
-			pushOCIImageForDownload(t, extensionDir, "./Dockerfile", manifest)
+			// Build and push the single-platform image to the registry via the Makefile's push_image
+			// target, then check its annotations are usable by boe download.
+			// #nosec G204
+			pushCmd := exec.CommandContext(ctx, "make", "push_image", "PLATFORMS=linux/"+runtime.GOARCH)
+			pushCmd.Dir = extensionDir
+			pushOutput, err := pushCmd.CombinedOutput()
+			t.Logf("make push_image output: %s", string(pushOutput))
+			require.NoError(t, err, "Makefile push_image target should be valid")
+
 			requireDownloadHasFiles(t, manifest, "manifest.yaml")
 		})
 	}
 }
 
-// pushOCIImageForDownload pushes the extension image to the test registry in OCI format,
-// preserving the manifest annotations required by boe download.
-// It does not use the `make push_image` target because it is meant for multi-platform builds
-// and here we want to build for a single platform. We call directly buildx build with the
-// minimum set of annotations and config.
-func pushOCIImageForDownload(t *testing.T, extensionDir, dockerfile string, manifest *extensions.Manifest) {
-	t.Helper()
-	ctx := t.Context()
-
-	// Ensure boe-builder exists; the Makefile's create_builder target is idempotent.
-	// #nosec G204
-	createBuilderCmd := exec.CommandContext(ctx, "make", "create_builder")
-	createBuilderCmd.Dir = extensionDir
-	out, err := createBuilderCmd.CombinedOutput()
-	t.Logf("make create_builder output: %s", string(out))
-	require.NoError(t, err, "Should be able to ensure boe-builder exists")
-
-	args := []string{
-		"buildx", "build",
-		"--builder", "boe-builder",
-		"--platform", fmt.Sprintf("linux/%s", runtime.GOARCH),
-		"--output", "type=registry,oci-mediatypes=true,registry.insecure=true",
-		"--provenance=false",
-		"--tag", fmt.Sprintf("%s/extension-%s:%s", registryAddr, manifest.Name, manifest.Version),
-		"-f", dockerfile,
-		"--annotation", fmt.Sprintf("manifest:org.opencontainers.image.title=%s", manifest.Name),
-		"--annotation", fmt.Sprintf("manifest:org.opencontainers.image.version=%s", manifest.Version),
-		"--annotation", fmt.Sprintf("manifest:%s=%s", extensions.OCIAnnotationExtensionType, string(manifest.Type)),
-		"--annotation", fmt.Sprintf("manifest:%s=%s", extensions.OCIAnnotationCShared, strconv.FormatBool(manifest.CShared)),
-	}
-	if manifest.Type == extensions.TypeGo {
-		args = append(args, "--build-arg", fmt.Sprintf("NAME=%s", manifest.Name))
-	}
-	if len(manifest.FilterTypes) > 0 {
-		filterTypes := make([]string, len(manifest.FilterTypes))
-		for i, ft := range manifest.FilterTypes {
-			filterTypes[i] = string(ft)
-		}
-		args = append(args, "--annotation", fmt.Sprintf("manifest:%s=%s", extensions.OCIAnnotationFilterType, strings.Join(filterTypes, ",")))
-	}
-	args = append(args, ".")
-
-	// #nosec G204
-	pushCmd := exec.CommandContext(ctx, "docker", args...)
-	pushCmd.Dir = extensionDir
-	output, err := pushCmd.CombinedOutput()
-	t.Logf("pushOCIImageForDownload output: %s", string(output))
-	require.NoError(t, err, "Should be able to push OCI image to local registry")
-}
-
 func fetchManifest(t *testing.T, registry, repository, reference string) {
 	url := fmt.Sprintf("http://%s/v2/%s/manifests/%s", registry, repository, reference)
 	// Set Accept header to request OCI media types to ensure the manifest is in OCI format

cli/e2e/run_test.go

@@ -13,7 +13,6 @@ import (
 	"net/http/httptest"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"runtime"
 	"strings"
 	"testing"
@@ -326,7 +325,8 @@ func dummy() string {
 // corazaBuildTags mirrors BUILD_TAGS in extensions/composer/Makefile.common; the composer and its
 // TestGoPluginLoaderRemoteExtension exercises the raw goplugin-loader extension end to end:
 //  1. build the example Go plugin image and push it to the local test registry;
-//  2. build the composer-lite image and extract libcomposer.so into the local cache;
+//  2. build the composer-lite image and push it to the local test registry, so boe downloads
+//     libcomposer.so from there into the local cache;
 //  3. run `boe run --extension goplugin-loader --config '{"name":...,"url":"oci://..."}'`
 //     and assert the dynamically loaded plugin processes responses.
 //
@@ -358,32 +358,25 @@ func TestGoPluginLoaderRemoteExtension(t *testing.T) {
 	dataHome := t.TempDir()
 	t.Setenv("BOE_DATA_HOME", dataHome)
 
-	// The build_image targets below run on the active buildx builder. Select the default (docker
-	// driver) builder: it builds via the Docker daemon, reusing the daemon's local base-image cache
-	// and proxy/registry configuration, which keeps a single-platform local build (type=docker)
-	// self-contained. We only need a local image to push, not a multi-platform registry export.
-	runCmd(t, "", "docker", "buildx", "use", "default")
-
-	// Step 1: build the example Go plugin image (single-platform, --output type=docker) and push it
-	// to the local registry. We use build_image rather than push_image: the latter does a
-	// multi-platform registry export with index-level OCI annotations, which buildkit rejects for a
-	// single-platform export ("index annotations not supported for single platform export").
-	// build_image tags the image <HUB>/extension-<name>:<version>-<os>-<arch>, with HUB derived from
-	// OCI_REGISTRY; we then push that tag (the daemon treats localhost/127.0.0.1 as insecure).
-	pluginRef := fmt.Sprintf("%s/built-on-envoy/extension-example-go:%s-linux-%s", registryAddr, version, runtime.GOARCH)
-	runCmd(t, composerDir, "make", "-f", "Makefile.plugin", "build_image",
+	// Step 1: build the example Go plugin image for the local platform and push it to the local
+	// registry via the Makefile's push_image target. PLATFORMS=linux/<arch> selects a single-platform
+	// export, for which push_image emits manifest-level OCI annotations (no index annotations, which
+	// buildkit rejects for single-platform). The target pushes directly (--output type=registry), so
+	// no separate docker push is needed. It tags the image <HUB>/extension-<name>:<version>, with HUB
+	// derived from OCI_REGISTRY; BOE_REGISTRY_INSECURE (set above) makes the export insecure.
+	pluginRef := fmt.Sprintf("%s/built-on-envoy/extension-example-go:%s", registryAddr, version)
+	runCmd(t, composerDir, "make", "-f", "Makefile.plugin", "push_image",
+		"PLATFORMS=linux/"+runtime.GOARCH,
 		"EXTENSION_PATH=example",
 		"OCI_REGISTRY="+registryAddr,
 	)
-	runCmd(t, "", "docker", "push", pluginRef)
 	pluginURL := "oci://" + pluginRef
 
-	// Step 2: build the composer-lite image and extract libcomposer.so into the local cache
-	// at <dataHome>/extensions/dym/composer/<version>/libcomposer.so.
-	runCmd(t, composerDir, "make", "build_image", "COMPOSER_LITE=true")
-	composerImage := fmt.Sprintf("%s/composer-lite:%s-linux-%s", registryAddr, version, runtime.GOARCH)
-	composerCacheDir := filepath.Join(dataHome, "extensions", "dym", "composer", version)
-	extractFileFromImage(t, composerImage, "/libcomposer.so", filepath.Join(composerCacheDir, "libcomposer.so"))
+	// Step 2: build the composer-lite image and push it to the local registry (as
+	// <registry>/composer-lite:<version>). When the goplugin-loader runs in Step 3, boe downloads
+	// libcomposer.so from there into <dataHome>/extensions/dym/composer/<version>/libcomposer.so.
+	// This exercises the real composer download path instead of extracting the file manually.
+	runCmd(t, composerDir, "make", "push_image", "COMPOSER_LITE=true", "PLATFORMS=linux/"+runtime.GOARCH)
 
 	// Step 3: run the goplugin-loader extension, pointing it at the pushed plugin image via
 	// the user-supplied URL.
@@ -404,28 +397,6 @@ func TestGoPluginLoaderRemoteExtension(t *testing.T) {
 		})
 }
 
-// extractFileFromImage copies a single file out of a locally-built (loaded) Docker image into dst.
-func extractFileFromImage(t *testing.T, image, srcPath, dst string) {
-	t.Helper()
-	require.NoError(t, os.MkdirAll(filepath.Dir(dst), 0o750))
-
-	// The composer image is FROM scratch with no default command, so "docker create" needs an
-	// explicit (dummy) command. It is never executed; we only use the container's filesystem.
-	// #nosec G204 -- test-controlled image reference.
-	created, err := exec.CommandContext(t.Context(), "docker", "create", image, "extract").Output()
-	require.NoError(t, err, "docker create %s", image)
-	containerID := strings.TrimSpace(string(created))
-	t.Cleanup(func() {
-		// #nosec G204 -- container ID produced by docker create above.
-		_ = exec.Command("docker", "rm", "-f", containerID).Run()
-	})
-
-	// #nosec G204 -- test-controlled container ID and paths.
-	out, err := exec.CommandContext(t.Context(), "docker", "cp", containerID+":"+srcPath, dst).CombinedOutput()
-	require.NoError(t, err, "docker cp %s: %s", srcPath, out)
-	require.FileExists(t, dst)
-}
-
 // runCmd runs name with args (in dir, if non-empty), logging the combined output and failing the
 // test on a non-zero exit.
 func runCmd(t *testing.T, dir, name string, args ...string) {

cli/internal/testing/docker.go

@@ -9,7 +9,9 @@ import (
 	"context"
 	"fmt"
 	"math/rand"
+	"os"
 	"os/exec"
+	"strings"
 	"testing"
 	"time"
 
@@ -23,13 +25,29 @@ var rnd = rand.New(rand.NewSource(time.Now().UnixNano())) //nolint: gosec
 func CreateBuildxBuilder(ctx context.Context) (string, func(), error) {
 	// Create a new builder instance that uses the custom buildkit configuration and host network.
 	builderName := fmt.Sprintf("test-builder-%d", rnd.Int())
-	// #nosec G204
-	createBuilderCmd := exec.CommandContext(ctx, "docker", "buildx", "create",
+	args := []string{
+		"buildx", "create",
 		"--name", builderName,
 		"--use",
 		"--driver", "docker-container",
 		"--driver-opt", "network=host",
-	)
+	}
+	// Forward proxy settings into the buildkit container. The buildx CLI does not propagate these
+	// automatically to docker-container builders, so in proxied environments buildkit would dial
+	// public registries (e.g. docker.io) directly and time out when pulling base images. Each
+	// "env.KEY=value" token is wrapped in quotes so buildx's CSV driver-opt parser keeps
+	// comma-separated values (such as NO_PROXY) intact.
+	for _, key := range []string{"HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"} {
+		v := os.Getenv(key)
+		if v == "" {
+			v = os.Getenv(strings.ToLower(key))
+		}
+		if v != "" {
+			args = append(args, "--driver-opt", fmt.Sprintf(`"env.%s=%s"`, key, v))
+		}
+	}
+	// #nosec G204
+	createBuilderCmd := exec.CommandContext(ctx, "docker", args...)
 	if err := createBuilderCmd.Run(); err != nil {
 		return "", nil, fmt.Errorf("failed to create buildx builder: %w", err)
 	}

extensions/Makefile

@@ -47,7 +47,8 @@ SOURCE := https://$(subst ghcr.io,github.com,$(HUB))
 # last development version.
 # We still keep the versioned development tag because the `boe run` command relies on those when
 # using the `--dev` flag.
-DEV_LATEST := $(firstword $(subst :, ,$(IMAGE))):dev
+# Strip the trailing ':<version>' tag from IMAGE (not every colon, so registry host:port is kept).
+DEV_LATEST := $(patsubst %:$(VERSION)$(IMAGE_NONCE),%,$(IMAGE)):dev
 DEV_TAG    := $(if $(filter %-dev,$(VERSION)),--tag $(DEV_LATEST))
 
 # Base OCI image annotations (shared by all image types)

extensions/composer/Makefile

@@ -54,7 +54,8 @@ COMPOSER_BUILD_TAG := $(if $(BUILD_TAGS),-tags $(BUILD_TAGS))
 # last development version.
 # We still keep the versioned development tag because the `boe run` command relies on those when
 # using the `--dev` flag.
-DEV_LATEST := $(firstword $(subst :, ,$(IMAGE))):dev
+# Strip the trailing ':<version>' tag from IMAGE (not every colon, so registry host:port is kept).
+DEV_LATEST := $(patsubst %:$(VERSION)$(IMAGE_NONCE),%,$(IMAGE)):dev
 DEV_TAG    := $(if $(filter %-dev,$(VERSION)),--tag $(DEV_LATEST))
 
 OS := linux

extensions/composer/Makefile.plugin

@@ -52,7 +52,8 @@ SOURCE := https://$(subst ghcr.io,github.com,$(HUB))
 # last development version.
 # We still keep the versioned development tag because the `boe run` command relies on those when
 # using the `--dev` flag.
-DEV_LATEST := $(firstword $(subst :, ,$(IMAGE))):dev
+# Strip the trailing ':<version>' tag from IMAGE (not every colon, so registry host:port is kept).
+DEV_LATEST := $(patsubst %:$(VERSION)$(IMAGE_NONCE),%,$(IMAGE)):dev
 DEV_TAG    := $(if $(filter %-dev,$(VERSION)),--tag $(DEV_LATEST))
 
 ARCH := $(shell uname -m)