Build test runner image #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build test runner image | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 6 * * 1' | |
| # Minimum permissions. `id-token: write` is required for OIDC-backed | |
| # signing of the build provenance attestation; `attestations: write` | |
| # is required to upload that attestation to the GHCR package. | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| concurrency: | |
| group: build-test-runner-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }}-runner | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # PHP 8.0 Chromium is pinned: Alpine 3.16 is EOL with no upstream updates. | |
| # PHP 8.4 Chromium floats: picks latest from Alpine on each rebuild. | |
| # Verify Chromium availability with: | |
| # `docker run --rm php:<ver>-cli-alpine sh -c 'apk update; apk policy chromium'`. | |
| include: | |
| - php_version: '8.0' | |
| chromium_version: '102.0.5005.182-r0' | |
| - php_version: '8.4' | |
| chromium_version: '' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Resolve content version | |
| id: content_version | |
| run: echo "value=v$(date -u +%Y%m%dT%H%M%SZ)" >> "$GITHUB_OUTPUT" | |
| - name: Lowercase image name | |
| id: image | |
| run: echo "name=${IMAGE_NAME,,}" >> "$GITHUB_OUTPUT" | |
| - name: Select build cache backend | |
| id: cache | |
| run: | | |
| if [ -n "${ACT:-}" ]; then | |
| # act's cache server is incompatible with buildx's gha exporter | |
| # (nektos/act#1916), so disable the cache backend under act. Layer | |
| # reuse instead comes from the host docker daemon's own build cache | |
| # (see the act-skipped "Set up Docker Buildx" step below). | |
| echo "from=" >> "$GITHUB_OUTPUT" | |
| echo "to=" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "from=type=gha,scope=test-runner-php${{ matrix.php_version }}" >> "$GITHUB_OUTPUT" | |
| echo "to=type=gha,mode=max,scope=test-runner-php${{ matrix.php_version }}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Set up Docker Buildx | |
| # Skipped under act: the container-driver builder's cache is discarded | |
| # on cleanup, so its layers wouldn't survive between local runs. Without | |
| # it, Pass 1 builds on the default docker driver and reuses the host | |
| # daemon's own build cache, which persists. Pass 2 (the only multi-arch | |
| # step) needs this builder but is already act-skipped. | |
| if: ${{ !env.ACT }} | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: 'Pass 1: Build test image (amd64 only, load to docker daemon)' | |
| id: build_test | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| push: false | |
| load: true | |
| platforms: linux/amd64 | |
| build-args: | | |
| PHP_VERSION=${{ matrix.php_version }} | |
| CHROMIUM_VERSION=${{ matrix.chromium_version }} | |
| tags: test-runner:php${{ matrix.php_version }} | |
| cache-from: ${{ steps.cache.outputs.from }} | |
| cache-to: ${{ steps.cache.outputs.to }} | |
| - name: Bootstrap WordPress in test image | |
| run: docker run --rm -v "$PWD:/var/www/html" -w /var/www/html test-runner:php${{ matrix.php_version }} bash resources/install.sh | |
| - name: Install PHP dependencies in test image | |
| # The named volume persists Composer's download cache (COMPOSER_HOME) | |
| # across runs, since the container itself is removed (--rm). Keyed per | |
| # PHP version so parallel matrix legs don't contend on one cache. | |
| run: docker run --rm -v "$PWD:/var/www/html" -v "aztec-wp-browser-composer-php${{ matrix.php_version }}:/tmp/composer" -w /var/www/html test-runner:php${{ matrix.php_version }} composer update | |
| - name: Run acceptance tests | |
| run: docker run --rm -v "$PWD:/var/www/html" -w /var/www/html test-runner:php${{ matrix.php_version }} codecept run acceptance | |
| - name: 'Pass 2: Build and push (amd64 + arm64, only if tests passed)' | |
| id: build | |
| if: ${{ !env.ACT }} | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| build-args: | | |
| PHP_VERSION=${{ matrix.php_version }} | |
| CHROMIUM_VERSION=${{ matrix.chromium_version }} | |
| tags: | | |
| ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}:php${{ matrix.php_version }} | |
| ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}:${{ steps.content_version.outputs.value }}-php${{ matrix.php_version }} | |
| cache-from: ${{ steps.cache.outputs.from }} | |
| cache-to: ${{ steps.cache.outputs.to }} | |
| provenance: mode=max | |
| sbom: true | |
| - name: Attest build provenance | |
| if: ${{ !env.ACT }} | |
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 | |
| with: | |
| subject-name: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }} | |
| subject-digest: ${{ steps.build.outputs.digest }} | |
| push-to-registry: true |