|
| 1 | +"""``.github/scripts/mirror_base_images.py``, which pulls the base images Dockerfiles name on public.ecr.aws from |
| 2 | +mirror.gcr.io before a workflow builds them, falling back to public.ecr.aws for one the mirror doesn't give.""" |
| 3 | + |
| 4 | +from __future__ import annotations |
| 5 | + |
| 6 | +import ast |
| 7 | +import json |
| 8 | +import subprocess |
| 9 | +import sys |
| 10 | + |
| 11 | +import pytest |
| 12 | + |
| 13 | +from agent_env.env import bootstrap |
| 14 | +from tst.util.scripts import SCRIPTS, load_script |
| 15 | + |
| 16 | +REPO = SCRIPTS.parents[1] |
| 17 | +SCRIPT = SCRIPTS / "mirror_base_images.py" |
| 18 | +_DIGEST = "sha256:" + "c" * 64 |
| 19 | +_PINNED = f"public.ecr.aws/docker/library/python:3.11-slim@{_DIGEST}" |
| 20 | +_TAGGED = "public.ecr.aws/docker/library/postgres:16-alpine" |
| 21 | + |
| 22 | + |
| 23 | +@pytest.fixture |
| 24 | +def script(): |
| 25 | + return load_script(SCRIPT.name) |
| 26 | + |
| 27 | + |
| 28 | +def test_it_imports_only_the_standard_library(): |
| 29 | + """The release's image builds run it in a job that holds a token to push, which installs nothing.""" |
| 30 | + imported = set() |
| 31 | + for node in ast.walk(ast.parse(SCRIPT.read_text())): |
| 32 | + if isinstance(node, ast.Import): |
| 33 | + imported |= {alias.name.split(".")[0] for alias in node.names} |
| 34 | + elif isinstance(node, ast.ImportFrom) and node.level == 0: |
| 35 | + imported.add(node.module.split(".")[0]) |
| 36 | + |
| 37 | + assert imported - {"__future__"} <= sys.stdlib_module_names, imported - sys.stdlib_module_names |
| 38 | + |
| 39 | + |
| 40 | +def test_it_finds_each_public_ecr_base_once(script, tmp_path): |
| 41 | + (tmp_path / "a").mkdir() |
| 42 | + (tmp_path / "a" / "Dockerfile").write_text(f"FROM {_PINNED}\nRUN true\nFROM ghcr.io/astral-sh/uv:latest AS uv\n") |
| 43 | + (tmp_path / "a" / "Dockerfile.db-mcp").write_text(f"from --platform=$BUILDPLATFORM {_TAGGED} AS build\n") |
| 44 | + (tmp_path / "b").mkdir() |
| 45 | + (tmp_path / "b" / "Dockerfile").write_text(f"# FROM {_TAGGED}:old\nFROM {_PINNED}\n") |
| 46 | + (tmp_path / "b" / "README.md").write_text("FROM public.ecr.aws/docker/library/node:22\n") |
| 47 | + |
| 48 | + assert script._bases([tmp_path]) == [_TAGGED, _PINNED] |
| 49 | + assert script._bases([tmp_path / "a" / "Dockerfile.db-mcp"]) == [_TAGGED] |
| 50 | + |
| 51 | + |
| 52 | +def test_it_finds_the_bases_of_the_images_agent_env_ships(script): |
| 53 | + bases = script._bases([image.dockerfile for image in bootstrap.PUBLISHED_IMAGES]) |
| 54 | + |
| 55 | + assert bases and all(base.startswith(script.ECR) for base in bases) |
| 56 | + assert any("@sha256:" in base for base in bases) |
| 57 | + |
| 58 | + |
| 59 | +@pytest.mark.parametrize("base, mirrored", [ |
| 60 | + (_PINNED, f"mirror.gcr.io/library/python@{_DIGEST}"), |
| 61 | + (_TAGGED, "mirror.gcr.io/library/postgres:16-alpine"), |
| 62 | +]) |
| 63 | +def test_a_base_is_pulled_by_its_digest_when_it_has_one(script, base, mirrored): |
| 64 | + assert script._mirrored(base) == mirrored |
| 65 | + |
| 66 | + |
| 67 | +def _docker(monkeypatch, script, *, store="overlay2", pulls_fail=0): |
| 68 | + """Fakes the commands the script runs, recording them; the first ``pulls_fail`` pulls fail.""" |
| 69 | + ran, failures, driver = [], iter(range(pulls_fail)), [store] |
| 70 | + |
| 71 | + def run(argv, **kwargs): |
| 72 | + ran.append(argv) |
| 73 | + if argv[:2] == ["docker", "info"]: |
| 74 | + return subprocess.CompletedProcess(argv, 0, json.dumps([["driver-type", driver[0]]]), "") |
| 75 | + if argv[:2] == ["sudo", "systemctl"]: |
| 76 | + driver[0] = "io.containerd.snapshotter.v1" |
| 77 | + if argv[:2] == ["sudo", "tee"]: |
| 78 | + ran.append(json.loads(kwargs["input"])) |
| 79 | + failed = argv[:2] == ["docker", "pull"] and next(failures, None) is not None |
| 80 | + return subprocess.CompletedProcess(argv, 1 if failed else 0, "", "") |
| 81 | + |
| 82 | + monkeypatch.setattr(script.subprocess, "run", run) |
| 83 | + monkeypatch.setattr(script.time, "sleep", lambda seconds: ran.append(["sleep", seconds])) |
| 84 | + return ran |
| 85 | + |
| 86 | + |
| 87 | +def test_a_pinned_base_is_named_in_containerd_on_its_image_store(script, monkeypatch, tmp_path): |
| 88 | + config = tmp_path / "daemon.json" |
| 89 | + config.write_text('{"exec-opts": ["native.cgroupdriver=cgroupfs"]}\n') |
| 90 | + monkeypatch.setattr(script, "_DAEMON_CONFIG", config) |
| 91 | + ran = _docker(monkeypatch, script) |
| 92 | + dockerfile = tmp_path / "Dockerfile" |
| 93 | + dockerfile.write_text(f"FROM {_PINNED}\n") |
| 94 | + |
| 95 | + assert script.main([str(dockerfile)]) == 0 |
| 96 | + |
| 97 | + mirrored = f"mirror.gcr.io/library/python@{_DIGEST}" |
| 98 | + assert ran == [ |
| 99 | + ["docker", "info", "--format", "{{json .DriverStatus}}"], |
| 100 | + ["sudo", "tee", str(config)], |
| 101 | + {"exec-opts": ["native.cgroupdriver=cgroupfs"], "features": {"containerd-snapshotter": True}}, |
| 102 | + ["sudo", "systemctl", "restart", "docker"], |
| 103 | + ["docker", "info", "--format", "{{json .DriverStatus}}"], |
| 104 | + ["docker", "pull", "--quiet", mirrored], |
| 105 | + ["docker", "tag", mirrored, "public.ecr.aws/docker/library/python:3.11-slim"], |
| 106 | + ["sudo", "ctr", "--namespace", "moby", "images", "tag", "--force", mirrored, _PINNED], |
| 107 | + ] |
| 108 | + |
| 109 | + |
| 110 | +def test_dockerd_is_left_alone_when_no_base_is_pinned(script, monkeypatch, tmp_path): |
| 111 | + ran = _docker(monkeypatch, script) |
| 112 | + dockerfile = tmp_path / "Dockerfile" |
| 113 | + dockerfile.write_text(f"FROM {_TAGGED}\n") |
| 114 | + |
| 115 | + assert script.main([str(dockerfile)]) == 0 |
| 116 | + |
| 117 | + assert ran == [["docker", "pull", "--quiet", "mirror.gcr.io/library/postgres:16-alpine"], |
| 118 | + ["docker", "tag", "mirror.gcr.io/library/postgres:16-alpine", _TAGGED]] |
| 119 | + |
| 120 | + |
| 121 | +def test_a_base_the_mirror_doesnt_give_is_left_to_its_build(script, monkeypatch, tmp_path, capsys): |
| 122 | + ran = _docker(monkeypatch, script, pulls_fail=3) |
| 123 | + dockerfile = tmp_path / "Dockerfile" |
| 124 | + dockerfile.write_text(f"FROM {_TAGGED}\n") |
| 125 | + |
| 126 | + assert script.main([str(dockerfile)]) == 0 |
| 127 | + |
| 128 | + pull = ["docker", "pull", "--quiet", "mirror.gcr.io/library/postgres:16-alpine"] |
| 129 | + assert ran == [pull, ["sleep", 10], pull, ["sleep", 20], pull] |
| 130 | + assert f"::warning::couldn't pull mirror.gcr.io/library/postgres:16-alpine, so {_TAGGED}'s build" in capsys.readouterr().out |
| 131 | + |
| 132 | + |
| 133 | +def test_a_pull_that_fails_once_is_tried_again(script, monkeypatch, tmp_path): |
| 134 | + ran = _docker(monkeypatch, script, pulls_fail=1) |
| 135 | + dockerfile = tmp_path / "Dockerfile" |
| 136 | + dockerfile.write_text(f"FROM {_TAGGED}\n") |
| 137 | + |
| 138 | + assert script.main([str(dockerfile)]) == 0 |
| 139 | + |
| 140 | + assert ran[-1] == ["docker", "tag", "mirror.gcr.io/library/postgres:16-alpine", _TAGGED] |
| 141 | + assert ["sleep", 10] in ran and ["sleep", 20] not in ran |
0 commit comments