imjasonh/terraform-playground
1
0
Fork 0
mirror of https://github.com/imjasonh/terraform-playground synced 2026-07-18 15:08:24 +00:00
Code Activity

Add py-image-builder CI: tests + lint, and a Docker-backed demo job on PRs

Browse source 
Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>
This commit is contained in:
Cursor Agent 2026-06-10 11:44:09 +00:00
parent 4c4d834ff3
commit 42c8aa50a4
No known key found for this signature in database
1 changed files with 178 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

178
.github/workflows/py-image-builder.yaml vendored Normal file
View file

@ -0,0 +1,178 @@
name: py-image-builder
on:
pull_request:
paths:
- "py-image-builder/**"
- ".github/workflows/py-image-builder.yaml"
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/setup-go@v6.2.0
with:
go-version-file: py-image-builder/go.mod
cache-dependency-path: py-image-builder/go.sum
- name: Run tests
working-directory: py-image-builder
run: go test -race ./...
- name: Run golangci-lint
uses: golangci/golangci-lint-action@v9.2.0
with:
working-directory: py-image-builder
version: latest
demo:
# Demonstrates the docker-less builder end to end against a real registry,
# then pulls and RUNS the built image with Docker to prove it works.
runs-on: ubuntu-latest
services:
registry:
image: registry:2
ports:
- 5000:5000
env:
REGISTRY: localhost:5000
BASE: python:3.12-slim
PYTHON: python3.12
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/setup-go@v6.2.0
with:
go-version-file: py-image-builder/go.mod
cache-dependency-path: py-image-builder/go.sum
- uses: actions/setup-python@v6.2.0
with:
python-version: "3.12"
- name: Build the CLI
working-directory: py-image-builder
run: go build -o pib .
- name: Prepare a demo app, wheelhouse, and hashed lock
working-directory: py-image-builder
run: |
set -euo pipefail
mkdir -p demo/wheelhouse demo/src
cat > demo/src/app.py <<'PY'
import click
import six
print("py-image-builder demo OK | six=%s click=%s" % (six.__version__, click.__version__))
PY
python -m pip install --upgrade pip
# Pure-python wheels (py3-none-any), resolved locally to keep the build hermetic.
pip download --no-deps --only-binary=:all: \
six==1.16.0 click==8.1.7 -d demo/wheelhouse
six_whl=$(ls demo/wheelhouse/six-*.whl)
click_whl=$(ls demo/wheelhouse/click-*.whl)
{
echo "six==1.16.0 --hash=sha256:$(sha256sum "$six_whl" | awk '{print $1}')"
echo "click==8.1.7 --hash=sha256:$(sha256sum "$click_whl" | awk '{print $1}')"
} > demo/requirements.txt
echo "----- requirements.txt -----"
cat demo/requirements.txt
- name: Build and push the image (no Docker daemon involved)
working-directory: py-image-builder
run: |
set -euo pipefail
./pib build \
--base "$BASE" \
--lock demo/requirements.txt \
--find-links demo/wheelhouse \
--source demo/src \
--python "$PYTHON" \
--entrypoint python --entrypoint /app/app.py \
--sbom demo/sbom.json \
--insecure \
-t "$REGISTRY/demo:v1"
echo "----- SBOM -----"
cat demo/sbom.json
- name: Verify the build is reproducible (same digest twice)
working-directory: py-image-builder
run: |
set -euo pipefail
common=(--base "$BASE" --lock demo/requirements.txt --find-links demo/wheelhouse \
--source demo/src --python "$PYTHON" \
--entrypoint python --entrypoint /app/app.py --insecure --push=false)
d1=$(./pib build "${common[@]}" --print-digest)
d2=$(./pib build "${common[@]}" --print-digest)
echo "digest #1: $d1"
echo "digest #2: $d2"
if [ "$d1" != "$d2" ]; then
echo "::error::build is not reproducible: $d1 != $d2"
exit 1
fi
echo "Reproducible: $d1"
- name: Pull and RUN the image with Docker
run: |
set -euo pipefail
docker pull "$REGISTRY/demo:v1"
out=$(docker run --rm "$REGISTRY/demo:v1")
echo "container output: $out"
echo "$out" | grep -q "py-image-builder demo OK"
- name: Install crane (for manifest inspection)
run: go install github.com/google/go-containerregistry/cmd/crane@v0.19.2
- name: Adding a dependency reuses existing layers (only one new layer)
working-directory: py-image-builder
run: |
set -euo pipefail
# Resolve one more pure-python wheel and append it to the lock.
pip download --no-deps --only-binary=:all: idna==3.7 -d demo/wheelhouse
idna_whl=$(ls demo/wheelhouse/idna-*.whl)
echo "idna==3.7 --hash=sha256:$(sha256sum "$idna_whl" | awk '{print $1}')" >> demo/requirements.txt
# Build the new image (now with the extra dependency) and push it.
./pib build \
--base "$BASE" \
--lock demo/requirements.txt \
--find-links demo/wheelhouse \
--source demo/src \
--python "$PYTHON" \
--entrypoint python --entrypoint /app/app.py \
--insecure \
-t "$REGISTRY/demo:v2"
# The new image still runs.
docker pull "$REGISTRY/demo:v2"
out=$(docker run --rm "$REGISTRY/demo:v2")
echo "container output: $out"
echo "$out" | grep -q "py-image-builder demo OK"
# Compare layer sets: every layer from v1 must still be present in v2
# (unchanged digests), and v2 must have exactly one more layer.
crane manifest --insecure "$REGISTRY/demo:v1" | jq -r '.layers[].digest' | sort > v1.layers
crane manifest --insecure "$REGISTRY/demo:v2" | jq -r '.layers[].digest' | sort > v2.layers
echo "v1 layers:"; cat v1.layers
echo "v2 layers:"; cat v2.layers
missing=$(comm -23 v1.layers v2.layers || true)
if [ -n "$missing" ]; then
echo "::error::these v1 layers changed/disappeared in v2 (should be reused):"
echo "$missing"
exit 1
fi
n1=$(wc -l < v1.layers)
n2=$(wc -l < v2.layers)
echo "layer counts: v1=$n1 v2=$n2"
if [ "$n2" -ne "$((n1 + 1))" ]; then
echo "::error::expected exactly one new layer, got $n1 -> $n2"
exit 1
fi
echo "Confirmed: adding a dependency reused all existing layers and added exactly one."