shadowdaoandClaude Sonnet 5.5
01741e735a
One job per matrix leg on the trusted x86 runner: amd64 built natively, arm64 under QEMU, each pushed BY DIGEST (untagged), then scripts/assemble-multiarch-index.sh creates the existing tags (:phpNN, :latest for php85 / shared-httpd :latest) from this run's digests. The arm64 step is continue-on-error with its own timeout, so an arm64 failure publishes the usual amd64-only tag and a stale arm64 is never re-attached. Build args, base-image pin, pkg-cache probe, php.net EXPECT_PHP_MIN gate, secrets and the cac-litespeed/cac-lsphp/shared-ols jobs are untouched. No Dockerfile change. Adds scripts/tests/multiarch-workflow.test.py (static wiring + tag-scheme execution) to Shell-Checks, and fixes index-platforms.test.sh line 17 which tripped lsphp-info-probe.test.sh's early-exit-reader scan on trunk. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
55 lines
3.5 KiB
Bash
Executable File
55 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
## index-platforms.test.sh — scripts/index-platforms.sh and
|
|
## scripts/assemble-multiarch-index.sh (copy of haproxy-manager-base's) against a stub IMAGETOOLS.
|
|
set -euo pipefail
|
|
HERE=$(cd "$(dirname "$0")/.." && pwd)
|
|
T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
|
|
fail=0
|
|
chk() { if [ "$2" = "$3" ]; then echo "ok $1"; else echo "FAIL $1: got '$2' want '$3'"; fail=1; fi; }
|
|
A=sha256:$(printf 'a%.0s' {1..64}); B=sha256:$(printf 'b%.0s' {1..64}); C=sha256:$(printf 'c%.0s' {1..64})
|
|
cat >"$T/it" <<'STUB'
|
|
#!/usr/bin/env bash
|
|
# index-platforms mode: serves $FIX/<ref-with-/:@ as _> for "inspect --raw REF".
|
|
# assemble mode (STUB_LOG set): "inspect REF --format .." -> arch from $ARCHES (ref=arch lines);
|
|
# "create ..." -> appended to $STUB_LOG.
|
|
if [ -n "${STUB_LOG:-}" ]; then
|
|
if [ "$1" = create ]; then echo "create $*" >>"$STUB_LOG"; exit 0; fi
|
|
ref=$2; a=$(grep -F -m1 "$ref=" "$ARCHES" | cut -d= -f2); [ -n "$a" ] || exit 1
|
|
printf '{"architecture":"%s"}' "$a"; exit 0
|
|
fi
|
|
[ "$2" = --raw ] || exit 2
|
|
k=$(printf '%s' "$3" | tr '/:@' '___')
|
|
if [ -f "$FIX/err_$k" ]; then cat "$FIX/err_$k" >&2; exit 1; fi
|
|
[ -f "$FIX/$k" ] || { echo "ERROR: $3: not found" >&2; exit 1; }
|
|
cat "$FIX/$k"
|
|
STUB
|
|
chmod +x "$T/it"; export IMAGETOOLS="$T/it" FIX=$T
|
|
w() { printf '%s' "$2" >"$T/$(printf '%s' "$1" | tr '/:@' '___')"; }
|
|
w r/i:idx '{"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"digest":"'$A'","platform":{"os":"linux","architecture":"amd64"}},{"digest":"'$B'","platform":{"os":"linux","architecture":"arm64"}},{"digest":"'$C'","platform":{"os":"unknown","architecture":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest"}}]}'
|
|
w r/i:amd '{"manifests":[{"digest":"'$A'","platform":{"os":"linux","architecture":"amd64"}},{"digest":"'$C'","platform":{"os":"unknown","architecture":"unknown"},"annotations":{"vnd.docker.reference.type":"attestation-manifest"}}]}'
|
|
w r/i:one '{"config":{"digest":"'$A'"},"layers":[]}'
|
|
w r/i:bad 'garbage'
|
|
printf 'ERROR: denied\n' >"$T/err_r_i_den"
|
|
chk "two-platform index" "$("$HERE/index-platforms.sh" r/i:idx)" "index linux/amd64 linux/arm64"
|
|
chk "amd64 index with attestation" "$("$HERE/index-platforms.sh" r/i:amd)" "index linux/amd64"
|
|
chk "single manifest" "$("$HERE/index-platforms.sh" r/i:one)" "single"
|
|
for pair in "nosuch 3" "bad 1" "den 1"; do set -- $pair
|
|
rc=0; "$HERE/index-platforms.sh" r/i:$1 >/dev/null 2>&1 || rc=$?; chk "$1 -> rc $2" "$rc" "$2"; done
|
|
|
|
# ---- assemble-multiarch-index.sh (arm64 attach rules)
|
|
export STUB_LOG=$T/log ARCHES=$T/arches
|
|
R=reg/x
|
|
printf '%s\n' "$R@$A=amd64" "$R@$B=arm64" >"$ARCHES"
|
|
run() { : >"$STUB_LOG"; "$HERE/assemble-multiarch-index.sh" "$@" >/dev/null 2>&1; echo $?; }
|
|
chk "both ok -> rc 0" "$(run --amd64 $A --arm64 $B --arm64-outcome success --repo $R --tag t1 --tag t2)" 0
|
|
chk "both ok -> 1 create with 2 sources, 2 tags" "$(grep -c "create create -t $R:t1 -t $R:t2 $R@$A $R@$B\$" "$STUB_LOG")" 1
|
|
chk "arm64 failed (digest present, stale) -> amd64 only" "$(run --amd64 $A --arm64 $B --arm64-outcome failure --repo $R --tag t1)" 0
|
|
chk " ... create has no arm64 digest" "$(grep -c "$B" "$STUB_LOG" || true)" 0
|
|
run --amd64 $A --repo $R --tag t1 >/dev/null
|
|
chk "arm64 skipped -> amd64 only" "$(grep -c "$B" "$STUB_LOG" || true)" "0"
|
|
chk "malformed amd64 digest -> refuse" "$(run --amd64 nope --repo $R --tag t1)" 1
|
|
chk " ... nothing created" "$(grep -c create "$STUB_LOG" || true)" 0
|
|
printf '%s\n' "$R@$A=arm64" >"$ARCHES"
|
|
chk "amd64 digest that is not amd64 -> refuse" "$(run --amd64 $A --repo $R --tag t1)" 1
|
|
[ "$fail" -eq 0 ] && echo "ALL PASS" || { echo FAILURES; exit 1; }
|