CI: surface risky Dockerfile content to reviewers, add Copilot review, fix S3 upload #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Validate a container pull request on a GitHub-hosted runner. | |
| # Runs in the untrusted PR context: NO secrets, NO push. It only builds + checks + | |
| # tests the container, writes report.json, and lets its job status reflect pass/fail. | |
| # The companion `pr-report.yml` (workflow_run) posts the status/comment afterwards, | |
| # so this works for fork PRs where the token here is read-only. | |
| name: pr-validate | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: pr-validate-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Compute changed files | |
| run: | | |
| git diff --name-only \ | |
| ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} \ | |
| > changed_files.txt | |
| echo "Changed files:"; cat changed_files.txt | |
| - name: Detect container and enforce PR rules | |
| id: detect | |
| run: | | |
| python3 .github/scripts/validate.py detect \ | |
| --changed-files changed_files.txt --out report.json | |
| # detect has already validated that container/version match [A-Za-z0-9._-]; | |
| # values are passed via env (never interpolated into the shell) and quoted. | |
| - name: Build image (amd64) | |
| env: | |
| C: ${{ steps.detect.outputs.container }} | |
| V: ${{ steps.detect.outputs.version }} | |
| run: docker build --no-cache --pull -t bcimg:pr "$C/$V" | |
| - name: Extract labels | |
| run: | | |
| docker inspect --format '{{json .Config.Labels}}' bcimg:pr > labels.json | |
| cat labels.json | |
| - name: Check labels and compute tag | |
| env: | |
| C: ${{ steps.detect.outputs.container }} | |
| V: ${{ steps.detect.outputs.version }} | |
| run: | | |
| python3 .github/scripts/validate.py check \ | |
| --container "$C" --version "$V" \ | |
| --labels labels.json --dockerfile "$C/$V/Dockerfile" --out report.json | |
| - name: Run tests (test-cmds.txt) | |
| env: | |
| C: ${{ steps.detect.outputs.container }} | |
| V: ${{ steps.detect.outputs.version }} | |
| run: | | |
| TESTS="$C/$V/test-cmds.txt" | |
| if [ ! -f "$TESTS" ]; then | |
| echo "No test-cmds.txt, skipping tests."; exit 0 | |
| fi | |
| status=0 | |
| while IFS= read -r cmd || [ -n "$cmd" ]; do | |
| cmd="${cmd%$'\r'}" # tolerate CRLF line endings | |
| case "$cmd" in ''|\#*) continue ;; esac # skip blank and comment lines | |
| echo "::group::TEST $cmd" | |
| if docker run --rm bcimg:pr $cmd; then echo "ok"; else echo "FAILED"; status=1; fi | |
| echo "::endgroup::" | |
| done < "$TESTS" | |
| exit $status | |
| - name: Upload report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: report | |
| path: report.json | |
| if-no-files-found: warn |