diff --git a/.gitea/workflows/backend-quality-gate.yml b/.gitea/workflows/backend-quality-gate.yml index 434f97ba..690e9a0a 100644 --- a/.gitea/workflows/backend-quality-gate.yml +++ b/.gitea/workflows/backend-quality-gate.yml @@ -50,27 +50,80 @@ jobs: - name: Install and verify Linux runner toolchain run: | set -euo pipefail - packages=() - command -v node >/dev/null || packages+=(nodejs) - command -v npm >/dev/null || packages+=(npm) if ! docker compose version --short 2>/dev/null | grep -Eq '^v?2\.'; then - packages+=(docker-compose-v2) - fi - if ((${#packages[@]})); then apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 \ -o Acquire::https::Timeout=30 update DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ - "${packages[@]}" + docker-compose-v2 fi python3 --version - node --version - npm --version curl --version + git --version + openssl version docker version docker compose version docker compose version --short | grep -Eq '^v?2\.' docker compose --help | grep -q -- '--project-name' + - name: Prepare pinned Node tooling + env: + NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c + NODE_TOOL_IMAGE: node:22-bookworm-slim + run: | + set -euo pipefail + if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then + for attempt in 1 2 3; do + if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then + break + fi + if [ "$attempt" -eq 3 ]; then + echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2 + exit 1 + fi + sleep $((attempt * 15)) + done + fi + docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE" + docker image inspect "$NODE_TOOL_IMAGE" >/dev/null + tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")" + cat > "$tool_dir/node" <<'EOF' + #!/usr/bin/env bash + set -euo pipefail + workdir="$(pwd -P)" + docker_args=( + run --rm --network host + --user "$(id -u):$(id -g)" + --group-add "$(stat -c %g /var/run/docker.sock)" + --volume "$workdir:$workdir" + --volume /tmp:/tmp + --volume /var/run/docker.sock:/var/run/docker.sock + --workdir "$workdir" + --env HOME=/tmp + --env "npm_config_cache=/tmp/jyotisha-npm-cache-${GITEA_SHA:-local}" + --env "DOCKER_CONFIG=/tmp/jyotisha-docker-config-${GITEA_SHA:-local}" + ) + for command_name in docker git openssl; do + command_path="$(command -v "$command_name")" + docker_args+=(--volume "$command_path:/usr/local/bin/$command_name:ro") + done + while read -r library; do + [ -f "$library" ] && docker_args+=(--volume "$library:$library:ro") + done < <(ldd "$(command -v openssl)" | awk '/lib(ssl|crypto)\.so/ { print $3 }') + for compose_plugin in \ + /usr/libexec/docker/cli-plugins/docker-compose \ + /usr/lib/docker/cli-plugins/docker-compose; do + [ -x "$compose_plugin" ] && docker_args+=(--volume "$compose_plugin:$compose_plugin:ro") + done + exec docker "${docker_args[@]}" node:22-bookworm-slim "${0##*/}" "$@" + EOF + chmod 0755 "$tool_dir/node" + ln -s node "$tool_dir/npm" + test -n "${GITHUB_PATH:-}" + printf '%s\n' "$tool_dir" >> "$GITHUB_PATH" + export PATH="$tool_dir:$PATH" + node --version + npm --version + - name: Preload PostgreSQL integration image env: POSTGRES_TEST_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/postgres:17-alpine @@ -143,6 +196,46 @@ jobs: test "$(git rev-parse HEAD)" = "$GITEA_SHA" test -z "$(git status --porcelain --untracked-files=all)" + - name: Prepare pinned Node tooling + env: + NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c + NODE_TOOL_IMAGE: node:22-bookworm-slim + run: | + set -euo pipefail + if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then + for attempt in 1 2 3; do + if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then + break + fi + if [ "$attempt" -eq 3 ]; then + echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2 + exit 1 + fi + sleep $((attempt * 15)) + done + fi + docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE" + docker image inspect "$NODE_TOOL_IMAGE" >/dev/null + tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")" + cat > "$tool_dir/node" <<'EOF' + #!/usr/bin/env bash + set -euo pipefail + workdir="$(pwd -P)" + exec docker run --rm \ + --user "$(id -u):$(id -g)" \ + --volume "$workdir:$workdir" \ + --workdir "$workdir" \ + --env HOME=/tmp \ + node:22-bookworm-slim "${0##*/}" "$@" + EOF + chmod 0755 "$tool_dir/node" + ln -s node "$tool_dir/npm" + test -n "${GITHUB_PATH:-}" + printf '%s\n' "$tool_dir" >> "$GITHUB_PATH" + export PATH="$tool_dir:$PATH" + node --version + npm --version + - name: Build and publish exact-SHA ACR images env: REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts index fc41ce90..099fa915 100644 --- a/frontend/tests/staging-backend-workflows.test.ts +++ b/frontend/tests/staging-backend-workflows.test.ts @@ -131,11 +131,22 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest", assert.equal((workflow.match(/git status --porcelain --untracked-files=all/g) ?? []).length, 2); assert.match(workflow, /python3 -m venv \.venv/); assert.match(workflow, /python -m playwright install --with-deps chromium/); - assert.match(workflow, /command -v node[^\n]+\|\| packages\+=\(nodejs\)/); - assert.match(workflow, /command -v npm[^\n]+\|\| packages\+=\(npm\)/); - assert.match(workflow, /packages\+=\(docker-compose-v2\)/); assert.equal((workflow.match(/Acquire::https::Timeout=30 update/g) ?? []).length, 1); - assert.match(workflow, /apt-get install -y --no-install-recommends[\s\S]*"\$\{packages\[@\]\}"/); + assert.match(workflow, /apt-get install -y --no-install-recommends[\s\S]*docker-compose-v2/); + assert.doesNotMatch(workflow, /packages\+=\((?:nodejs|npm)\)|apt-get install[^\n]*(?:nodejs|npm)/); + assert.equal((workflow.match(/NODE_TOOL_SOURCE_IMAGE: swr\.cn-north-4\.myhuaweicloud\.com\/ddn-k8s\/docker\.io\/library\/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c/g) ?? []).length, 2); + assert.equal((workflow.match(/NODE_TOOL_IMAGE: node:22-bookworm-slim/g) ?? []).length, 2); + assert.equal((workflow.match(/timeout 180 docker pull "\$NODE_TOOL_SOURCE_IMAGE"/g) ?? []).length, 2); + assert.equal((workflow.match(/docker tag "\$NODE_TOOL_SOURCE_IMAGE" "\$NODE_TOOL_IMAGE"/g) ?? []).length, 2); + assert.equal((workflow.match(/cat > "\$tool_dir\/node" <<'EOF'/g) ?? []).length, 2); + assert.equal((workflow.match(/--volume "\$workdir:\$workdir"/g) ?? []).length, 2); + assert.equal((workflow.match(/--workdir "\$workdir"/g) ?? []).length, 2); + assert.equal((workflow.match(/ln -s node "\$tool_dir\/npm"/g) ?? []).length, 2); + assert.equal((workflow.match(/>> "\$GITHUB_PATH"/g) ?? []).length, 2); + assert.match(workflow, /--volume \/var\/run\/docker\.sock:\/var\/run\/docker\.sock/); + assert.match(workflow, /--network host/); + assert.match(workflow, /node:22-bookworm-slim "\$\{0##\*\/\}" "\$@"/); + assert.doesNotMatch(workflow, /(?:--volume|-v)[^\n]*(?:\$HOME\/\.docker|DOCKER_CONFIG)/); assert.match(workflow, /node --version[\s\S]*npm --version/); assert.match(workflow, /docker compose version --short/); assert.match(workflow, /docker compose --help \| grep -q -- '--project-name'/);