fix(ci): gate images behind verified Testcontainers

2026-08-15 23:21:23 +07:00
parent 7a6139017f
commit d13443e338
7 changed files with 233 additions and 30 deletions
@@ -1,8 +1,10 @@
 name: Container

 'on':
-  pull_request:
+  workflow_dispatch:
  push:
+    branches:
+      - main

 permissions:
  contents: read
@@ -12,17 +14,66 @@ concurrency:
  cancel-in-progress: true

 jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      TESTCONTAINERS_HOST_OVERRIDE: host.docker.internal
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Java 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+
+      - name: Set up Node 24
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+          cache: npm
+
+      - name: Verify Docker for PostgreSQL tests
+        run: docker info
+
+      - name: Install frontend dependencies
+        run: npm ci
+
+      - name: Run frontend tests
+        run: npm run test:ui
+
+      - name: Build frontend assets
+        run: npm run build
+
+      - name: Verify generated assets are committed
+        run: git diff --exit-code -- src/main/resources/static/assets/app.css src/main/resources/static/assets/icons.svg
+
+      - name: Run Maven tests
+        run: ./mvnw -B test
+
+      - name: Verify Javadoc
+        run: ./mvnw -B -DskipTests -Ddoclint=all javadoc:javadoc
+
+      - name: Verify whitespace
+        run: git diff --check
+
  amd64:
+    needs: verify
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Select image tags
        id: image
@@ -54,14 +105,14 @@ jobs:

      - name: Log in to registry
        if: steps.image.outputs.publish == 'true'
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ steps.image.outputs.registry }}
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build AMD64 image and publish main
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64
@@ -73,42 +124,52 @@ jobs:
  arm64:
    # Gitea cannot schedule a probe on a missing label. Enable this repository variable only
    # while a trusted ubuntu-latest-arm runner is registered and online.
-    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' && vars.ARM64_RUNNER_AVAILABLE == 'true'
+    if: vars.ARM64_RUNNER_AVAILABLE == 'true'
+    needs: verify
    runs-on: ubuntu-latest-arm
    timeout-minutes: 30
    steps:
      - name: Check out source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

-      - name: Require image configuration
+      - name: Select image tag
        id: image
        env:
          CONFIGURED_IMAGE: ${{ vars.CONTAINER_IMAGE }}
+          EVENT_NAME: ${{ gitea.event_name }}
+          GITEA_REF: ${{ gitea.ref }}
          GITEA_SHA: ${{ gitea.sha }}
        run: |
-          test -n "$CONFIGURED_IMAGE" || { echo "Repository variable CONTAINER_IMAGE is required" >&2; exit 1; }
-          echo "image=$CONFIGURED_IMAGE" >> "$GITHUB_OUTPUT"
-          echo "registry=${CONFIGURED_IMAGE%%/*}" >> "$GITHUB_OUTPUT"
-          echo "tag=$CONFIGURED_IMAGE:sha-${GITEA_SHA}-arm64" >> "$GITHUB_OUTPUT"
+          publish=false
+          image=labtimesheet
+          if [ "$EVENT_NAME" = "push" ] && [ "$GITEA_REF" = "refs/heads/main" ]; then
+            test -n "$CONFIGURED_IMAGE" || { echo "Repository variable CONTAINER_IMAGE is required" >&2; exit 1; }
+            publish=true
+            image="$CONFIGURED_IMAGE"
+          fi
+          echo "publish=$publish" >> "$GITHUB_OUTPUT"
+          echo "registry=${image%%/*}" >> "$GITHUB_OUTPUT"
+          echo "tag=$image:sha-${GITEA_SHA}-arm64" >> "$GITHUB_OUTPUT"

      - name: Log in to registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        if: steps.image.outputs.publish == 'true'
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ steps.image.outputs.registry }}
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build native ARM64 image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/arm64
-          push: true
+          push: ${{ steps.image.outputs.publish }}
          tags: ${{ steps.image.outputs.tag }}
          build-args: |
            VCS_REF=${{ gitea.sha }}
@@ -120,7 +181,7 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Set up Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Resolve registry
        id: image
@@ -131,7 +192,7 @@ jobs:
          echo "registry=${CONFIGURED_IMAGE%%/*}" >> "$GITHUB_OUTPUT"

      - name: Log in to registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ steps.image.outputs.registry }}
          username: ${{ secrets.REGISTRY_USERNAME }}
@@ -15,21 +15,23 @@ jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 30
+    env:
+      TESTCONTAINERS_HOST_OVERRIDE: host.docker.internal
    steps:
      - name: Check out source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Java 25
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: '25'
          cache: maven

      - name: Set up Node 24
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: npm