test(relay): smoke published image platforms

Author: bobleer

.github/workflows/desktop-package.yml

@@ -383,6 +383,12 @@ jobs:
             REVISION=${{ needs.prepare.outputs.release_tag }}
           tags: ${{ steps.image-tags.outputs.value }}
 
+      - name: Smoke-test published image on both platforms
+        shell: bash
+        env:
+          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
+        run: bash scripts/relay/smoke-image.sh "${IMAGE}@${IMAGE_DIGEST}"
+
       - name: Verify manifest and generate signed descriptor
         shell: bash
         env:

.github/workflows/nightly.yml

@@ -337,6 +337,13 @@ jobs:
             ghcr.io/gcwing/bitfun-relay-server:${{ env.NIGHTLY_TAG }}
             ghcr.io/gcwing/bitfun-relay-server:${{ steps.nightly-image-meta.outputs.asset_version }}
 
+      - name: Smoke-test published Relay image on both platforms
+        shell: bash
+        env:
+          IMAGE_DIGEST: ${{ steps.relay-image.outputs.digest }}
+        run: bash scripts/relay/smoke-image.sh \
+          "ghcr.io/gcwing/bitfun-relay-server@${IMAGE_DIGEST}"
+
       - name: Generate signed Relay image descriptor
         shell: bash
         env:

scripts/relay/package-contract.test.mjs

@@ -44,6 +44,7 @@ test('formal and nightly releases publish signed anonymous multi-platform Relay
   const formal = read('.github/workflows/desktop-package.yml');
   const nightly = read('.github/workflows/nightly.yml');
   const dockerfile = read('src/apps/relay-server/Dockerfile.release');
+  const smoke = read('scripts/relay/smoke-image.sh');
 
   for (const workflow of [formal, nightly]) {
     assert.match(workflow, /packages:\s*write/);
@@ -52,12 +53,17 @@ test('formal and nightly releases publish signed anonymous multi-platform Relay
     assert.match(workflow, /ghcr\.io\/gcwing\/bitfun-relay-server/);
     assert.match(workflow, /relay-image\.json/);
     assert.match(workflow, /scripts\/sign-release-assets\.sh relay-image\.json/);
+    assert.match(workflow, /scripts\/relay\/smoke-image\.sh/);
     assert.match(workflow, /Verify anonymous .*image access|Verify anonymous pull access/);
     assert.match(workflow, /DOCKER_CONFIG="\$clean_config" docker buildx imagetools inspect/);
   }
   assert.match(formal, /latest_release=.*releases\/latest/);
   assert.doesNotMatch(nightly, /bitfun-relay-server:latest/);
 
+  assert.match(smoke, /for arch in amd64 arm64/);
+  assert.match(smoke, /\.State\.Health/);
+  assert.match(smoke, /docker logs --tail/);
+
   assert.match(dockerfile, /org\.opencontainers\.image\.source="https:\/\/github\.com\/GCWing\/BitFun"/);
   assert.match(dockerfile, /TARGETARCH/);
   assert.match(dockerfile, /bitfun-relay-server/);

scripts/relay/smoke-image.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+# Start every published Relay platform under the runner's native/QEMU runtime
+# and require the image's own HEALTHCHECK to pass before release metadata is
+# signed. Usage: smoke-image.sh <repository>@sha256:<multi-platform-digest>
+
+set -euo pipefail
+
+IMAGE_REF="${1:?usage: smoke-image.sh <repository>@sha256:<digest>}"
+if [[ ! "$IMAGE_REF" =~ @sha256:[0-9a-f]{64}$ ]]; then
+  echo "ERROR: Relay smoke test requires a digest-pinned image." >&2
+  exit 2
+fi
+
+containers=()
+cleanup() {
+  local container
+  for container in "${containers[@]}"; do
+    docker rm -fv "$container" >/dev/null 2>&1 || true
+  done
+}
+trap cleanup EXIT INT TERM
+
+for arch in amd64 arm64; do
+  container="bitfun-relay-smoke-${arch}"
+  containers+=("$container")
+  echo ">>> Smoke-testing ${IMAGE_REF} on linux/${arch}..."
+  docker run -d \
+    --name "$container" \
+    --platform "linux/${arch}" \
+    -e RELAY_PORT=9700 \
+    -e RELAY_STATIC_DIR=/app/static \
+    -e RELAY_ROOM_WEB_DIR=/app/room-web \
+    -e RELAY_DB_PATH=/app/data/bitfun_relay.db \
+    "$IMAGE_REF" >/dev/null
+
+  healthy=0
+  for _attempt in $(seq 1 45); do
+    status="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container")"
+    if [ "$status" = "healthy" ]; then
+      healthy=1
+      break
+    fi
+    if [ "$status" = "exited" ] || [ "$status" = "dead" ]; then
+      break
+    fi
+    sleep 2
+  done
+
+  if [ "$healthy" != "1" ]; then
+    echo "ERROR: linux/${arch} Relay image did not become healthy." >&2
+    docker inspect -f 'status={{.State.Status}} exit={{.State.ExitCode}} oom={{.State.OOMKilled}} error={{.State.Error}}' "$container" >&2 || true
+    docker logs --tail 80 "$container" >&2 || true
+    exit 1
+  fi
+  docker rm -fv "$container" >/dev/null
+  echo ">>> linux/${arch} Relay image is healthy."
+done
+
+trap - EXIT INT TERM