Docker image-export CI #704
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker image-export CI | |
| on: | |
| push: | |
| schedule: | |
| - cron: "05 04 * * 1" | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| env: | |
| REPO: jgraph/export-server | |
| HTTP_PORT: 32733 | |
| NONROOT_HTTP_PORT: 32734 | |
| DOCKER_USER: ${{ secrets.DOCKER_USER }} | |
| DOCKER_PASS: ${{ secrets.DOCKER_PASS }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Build the image-export Docker image | |
| run: | | |
| docker build -f image-export/Dockerfile -t ${REPO} image-export/ | |
| docker run --name "image-export" -d -p ${HTTP_PORT}:8000 ${REPO} | |
| sleep 12 | |
| docker logs image-export | |
| docker exec image-export /bin/bash -c "curl -i http://localhost:8000" | |
| # Render an actual diagram: a plain liveness check on / never launches | |
| # the browser, so it cannot catch a missing/broken Chrome. Assert a | |
| # real PNG comes back. | |
| STATUS=$(curl -sS -o /tmp/export-test.png -w '%{http_code}' \ | |
| -X POST "http://localhost:${HTTP_PORT}/" \ | |
| --data-urlencode 'format=png' \ | |
| --data-urlencode 'crop=1' \ | |
| --data-urlencode 'scale=1' \ | |
| --data-urlencode 'xml=<mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="2" value="CI render test" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1"><mxGeometry x="20" y="20" width="160" height="60" as="geometry"/></mxCell></root></mxGraphModel>') | |
| echo "Render HTTP ${STATUS}, $(wc -c < /tmp/export-test.png) bytes" | |
| # Puppeteer/Chrome render errors are logged by the worker process at | |
| # request time, so the pre-render 'docker logs' above cannot capture | |
| # them. Dump logs (and the response body) after the render so a 500 | |
| # surfaces the actual exception + stack in the CI output. | |
| echo "=== export-server logs (post-render) ===" | |
| docker logs image-export | |
| echo "=== render response body (first 500 bytes) ===" | |
| head -c 500 /tmp/export-test.png; echo | |
| test "${STATUS}" = "200" | |
| test "$(head -c 8 /tmp/export-test.png | od -An -tx1 | tr -d ' \n')" = "89504e470d0a1a0a" | |
| # Repeat the render under an arbitrary UID with GID 0 (OpenShift-style). | |
| # Rendering (not just liveness) is what exercises the two non-root | |
| # requirements: HOME resolvable for the Chrome launcher, and a writable | |
| # app dir for the Chrome profile. [jgraph/docker-drawio#186] | |
| docker run --name "image-export-nonroot" -d --user 12345:0 -p ${NONROOT_HTTP_PORT}:8000 ${REPO} | |
| sleep 12 | |
| STATUS=$(curl -sS -o /tmp/export-test-nonroot.png -w '%{http_code}' \ | |
| -X POST "http://localhost:${NONROOT_HTTP_PORT}/" \ | |
| --data-urlencode 'format=png' \ | |
| --data-urlencode 'crop=1' \ | |
| --data-urlencode 'scale=1' \ | |
| --data-urlencode 'xml=<mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="2" value="CI render test" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1"><mxGeometry x="20" y="20" width="160" height="60" as="geometry"/></mxCell></root></mxGraphModel>') | |
| echo "Non-root render HTTP ${STATUS}, $(wc -c < /tmp/export-test-nonroot.png) bytes" | |
| echo "=== export-server non-root logs (post-render) ===" | |
| docker logs image-export-nonroot | |
| test "${STATUS}" = "200" | |
| test "$(head -c 8 /tmp/export-test-nonroot.png | od -An -tx1 | tr -d ' \n')" = "89504e470d0a1a0a" | |
| echo "${DOCKER_PASS}" | docker login -u "${DOCKER_USER}" --password-stdin; | |
| # Publish an immutable, commit-pinned tag alongside the mutable | |
| # :latest so consumers can pin to a known-good build (#24). | |
| docker tag ${REPO} ${REPO}:latest; | |
| docker tag ${REPO} ${REPO}:${GITHUB_SHA}; | |
| docker push ${REPO}:latest; | |
| docker push ${REPO}:${GITHUB_SHA}; |