terraform-playground/.github/workflows/pymage.yaml

name: pymage

on:
  pull_request:
    paths:
      - "pymage/**"
      - ".github/workflows/pymage.yaml"

jobs:
  ci:
    # Runs on Linux, macOS, and Windows to prove pymage can build a multi-arch
    # *linux* image index from any host OS (it never needs a Docker daemon to
    # build). The Docker-only demonstration steps are gated to Linux, where the
    # daemon is available.
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
    env:
      BASE: python:3.12-slim
      PYTHON: python3.12
      REGISTRY: localhost:1338
    steps:
      - uses: actions/checkout@v6.0.2

      - uses: actions/setup-go@v6.2.0
        with:
          go-version-file: pymage/go.mod
          cache-dependency-path: pymage/go.sum

      - uses: actions/setup-python@v6.2.0
        with:
          python-version: "3.12"

      - name: Run tests
        working-directory: pymage
        run: go test -race ./...

      - name: Run golangci-lint
        if: runner.os == 'Linux'
        uses: golangci/golangci-lint-action@v9.2.0
        with:
          working-directory: pymage
          version: latest

      - name: Install crane
        run: |
          go install github.com/google/go-containerregistry/cmd/crane@v0.19.2
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      - name: Start a local registry (in-memory, cross-platform)
        run: |
          crane registry serve --address "$REGISTRY" &
          for _ in $(seq 1 30); do
            curl -fsS "http://$REGISTRY/v2/" >/dev/null 2>&1 && break
            sleep 1
          done
          curl -fsS "http://$REGISTRY/v2/" >/dev/null

      - name: Prepare demo app, wheelhouse, and hashed lock
        working-directory: pymage
        run: |
          set -euo pipefail
          mkdir -p demo/wheelhouse demo/src

          cat > demo/src/app.py <<'PY'
          import click
          import six

          print("pymage demo OK | six=%s click=%s" % (six.__version__, click.__version__))
          PY

          python -m pip install --upgrade pip
          # Pure-python wheels (py3-none-any): identical on every host OS and
          # compatible with every target platform.
          pip download --no-deps --only-binary=:all: \
            six==1.16.0 click==8.1.7 -d demo/wheelhouse

          # Generate a hashed lock with the interpreter (portable across OSes,
          # unlike sha256sum vs shasum differences).
          python - <<'PY'
          import glob, hashlib, os
          lines = []
          for whl in sorted(glob.glob("demo/wheelhouse/*.whl")):
              parts = os.path.basename(whl)[:-4].split("-")
              name, version = parts[0], parts[1]
              digest = hashlib.sha256(open(whl, "rb").read()).hexdigest()
              lines.append(f"{name}=={version} --hash=sha256:{digest}")
          open("demo/requirements.txt", "w").write("\n".join(lines) + "\n")
          print(open("demo/requirements.txt").read())
          PY

      - name: Build & push a multi-arch (linux/amd64 + linux/arm64) image
        working-directory: pymage
        run: |
          set -euo pipefail
          go run . build \
            --base "$BASE" \
            --platform linux/amd64,linux/arm64 \
            --lock demo/requirements.txt \
            --find-links demo/wheelhouse \
            --source demo/src \
            --python "$PYTHON" \
            --entrypoint python --entrypoint /app/app.py \
            --insecure \
            -t "$REGISTRY/demo:multi"

      - name: Verify the pushed artifact is a multi-arch index
        run: |
          set -euo pipefail
          crane manifest --insecure "$REGISTRY/demo:multi" > manifest.json
          cat manifest.json
          python - <<'PY'
          import json
          m = json.load(open("manifest.json"))
          plats = {f"{x['platform']['os']}/{x['platform']['architecture']}" for x in m.get("manifests", [])}
          print("platforms:", plats)
          assert "linux/amd64" in plats, plats
          assert "linux/arm64" in plats, plats
          print("multi-arch index OK")
          PY

      - name: Verify the multi-arch build is reproducible
        working-directory: pymage
        run: |
          set -euo pipefail
          common=(--base "$BASE" --platform linux/amd64,linux/arm64 --lock demo/requirements.txt \
                  --find-links demo/wheelhouse --source demo/src --python "$PYTHON" \
                  --entrypoint python --entrypoint /app/app.py --insecure --push=false)
          d1=$(go run . build "${common[@]}" --print-digest)
          d2=$(go run . build "${common[@]}" --print-digest)
          echo "digest #1: $d1"
          echo "digest #2: $d2"
          if [ "$d1" != "$d2" ]; then
            echo "::error::multi-arch build is not reproducible: $d1 != $d2"
            exit 1
          fi
          echo "reproducible: $d1"

      # The remaining steps require a Docker daemon, which is only available on
      # the Linux runners.
      - name: Pull and RUN the image with Docker
        if: runner.os == 'Linux'
        run: |
          set -euo pipefail
          docker pull "$REGISTRY/demo:multi"
          out=$(docker run --rm "$REGISTRY/demo:multi")
          echo "container output: $out"
          echo "$out" | grep -q "pymage demo OK"

      - name: Adding a dependency reuses existing layers (only one new layer)
        if: runner.os == 'Linux'
        working-directory: pymage
        run: |
          set -euo pipefail
          common=(--base "$BASE" --platform linux/amd64 --lock demo/requirements.txt \
                  --find-links demo/wheelhouse --source demo/src --python "$PYTHON" \
                  --entrypoint python --entrypoint /app/app.py --insecure)
          go run . build "${common[@]}" -t "$REGISTRY/demo:v1"

          pip download --no-deps --only-binary=:all: idna==3.7 -d demo/wheelhouse
          python - <<'PY'
          import glob, hashlib
          whl = sorted(glob.glob("demo/wheelhouse/idna-*.whl"))[0]
          digest = hashlib.sha256(open(whl, "rb").read()).hexdigest()
          open("demo/requirements.txt", "a").write(f"idna==3.7 --hash=sha256:{digest}\n")
          PY
          go run . build "${common[@]}" -t "$REGISTRY/demo:v2"

          crane manifest --insecure "$REGISTRY/demo:v1" | jq -r '.layers[].digest' | sort > v1.layers
          crane manifest --insecure "$REGISTRY/demo:v2" | jq -r '.layers[].digest' | sort > v2.layers
          echo "v1 layers:"; cat v1.layers
          echo "v2 layers:"; cat v2.layers
          if [ -n "$(comm -23 v1.layers v2.layers || true)" ]; then
            echo "::error::a v1 layer changed/disappeared in v2 (should be reused)"
            exit 1
          fi
          n1=$(wc -l < v1.layers)
          n2=$(wc -l < v2.layers)
          echo "layer counts: v1=$n1 v2=$n2"
          if [ "$n2" -ne "$((n1 + 1))" ]; then
            echo "::error::expected exactly one new layer, got $n1 -> $n2"
            exit 1
          fi
          echo "Confirmed: adding a dependency reused all existing layers and added exactly one."