-
Notifications
You must be signed in to change notification settings - Fork 2
Feat/testing the full image before publishing (issue #82) #12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
f416823
2bb8152
b86eb38
1f93012
70db6c7
bf031de
06d3f0c
68b5341
e0c324c
019e4c4
7815c6b
b0d7583
446b5e9
410ff28
d6080ff
d9fa188
57f52cb
b088497
1ac03c5
418f1ad
ef181c0
fb5ae28
0d42601
9823160
b716a70
48d88db
af32a5d
bce5cad
1ff6a8f
6893cee
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| root = true | ||
|
|
||
| [*] | ||
| charset = utf-8 | ||
| end_of_line = lf | ||
| indent_style = space | ||
| indent_size = 4 | ||
| insert_final_newline = true | ||
| trim_trailing_whitespace = true | ||
|
|
||
| [*.yml] | ||
| indent_size = 2 | ||
|
|
||
| [*.yaml] | ||
| indent_size = 2 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| name: CI Pipeline | ||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
|
|
||
| pull_request: | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v5 | ||
|
|
||
| - name: Setup Java 25 | ||
| uses: actions/setup-java@v5.2.0 | ||
| with: | ||
| distribution: 'temurin' | ||
| java-version: '25' | ||
| cache: 'maven' | ||
|
|
||
| - name: Run tests | ||
| run: ./mvnw -B test | ||
|
|
||
| - name: Run spotless checks | ||
| run: ./mvnw -B spotless:check | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| name: Publish Docker Image | ||
| on: | ||
| push: | ||
| tags: | ||
| - 'v*' | ||
|
|
||
| jobs: | ||
| publish: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| steps: | ||
| - name: Checkout repo | ||
| uses: actions/checkout@v6.0.2 | ||
|
|
||
| - name: Setup QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
|
|
||
| - name: Setup Docker BuildX | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Login to GHCR | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Extract Docker metadata | ||
| id: meta | ||
| uses: docker/metadata-action@v5 | ||
| with: | ||
| images: ghcr.io/${{ github.repository_owner }}/project-webserver-juv25d | ||
| tags: type=ref,event=tag | ||
| labels: org.opencontainers.image.source=${{ github.repository }} | ||
|
|
||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| context: . | ||
| push: true | ||
| platforms: linux/amd64,linux/arm64 | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
|
Comment on lines
+39
to
+46
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Integration tests are never executed before the image is published. The stated goal of this PR is "testing the full image before publishing," yet the release workflow contains no step that runs At a minimum, a step like the following should precede the push: - name: Run integration tests
run: ./mvnw verify -Dfailsafe.useFile=falseAlternatively, gate the tag-triggered release on a passing CI run that already executes 🤖 Prompt for AI Agents |
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,3 @@ | ||
| target/ | ||
| /.idea/ | ||
| /META-INF |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| wrapperVersion=3.3.4 | ||
| distributionType=only-script | ||
| distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.7/apache-maven-3.8.7-bin.zip |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| FROM maven:3.9-eclipse-temurin-25 AS build | ||
|
|
||
| WORKDIR /app | ||
|
|
||
| COPY pom.xml pom.xml | ||
| RUN mvn dependency:go-offline -B | ||
|
|
||
| COPY src ./src | ||
| RUN mvn clean package -DskipTests | ||
|
|
||
| FROM eclipse-temurin:25-jre-alpine | ||
|
|
||
| WORKDIR /app | ||
|
|
||
| # might need to update this later when we have our explicit class names | ||
| COPY --from=build /app/target/app.jar app.jar | ||
| ENTRYPOINT ["java", "-jar", "app.jar"] | ||
|
Comment on lines
+11
to
+17
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Container runs as root — add a non-root Trivy (DS-0002) flags this correctly. The final stage has no 🔒 Proposed fix FROM eclipse-temurin:25-jre-alpine
WORKDIR /app
-# might need to update this later when we have our explicit class names
COPY --from=build /app/target/app.jar app.jar
+
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+USER appuser
+
ENTRYPOINT ["java", "-jar", "app.jar"]The diff above also removes the stale comment on Line 15 — the JAR path is already explicit, so the comment no longer applies. 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Integration tests are never executed in CI — add a
verifystep.The pipeline runs
./mvnw -B test, which only invokes the Surefire unit-test phase.AppIT(the PR's core deliverable) is bound to the Failsafeintegration-testphase and only runs during./mvnw verify. As-is, the entire integration test suite is silently skipped in CI.🔧 Proposed fix
Or, collapse both into a single
verifyinvocation (Surefire runs automatically as part ofverify):📝 Committable suggestion
🤖 Prompt for AI Agents