test-image.yaml

---
name: "test image"

# yamllint disable-line rule:truthy
on:
  pull_request:
    paths:
    - 'images/**'
    - '.github/workflows/test-image.yaml'
  workflow_dispatch:
    inputs:
      verbosity:
        description: 'Log Verbosity'
        required: true
        default: 1
        type: choice
        options:
        - '0'
        - '1'
        - '2'
        - '3'
        - '4'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  image_name: ${{ secrets.CONTAINER_REGISTRY }}/${{ vars.CONTAINER_REGISTRY_PATH }}/coder-workspace
  image_cache_name: ${{ secrets.CONTAINER_REGISTRY }}/${{ vars.CONTAINER_REGISTRY_CACHE_PATH }}/coder-workspace
  image_path: images/homelab-workspace
  default_branch: main
  default_verbosity: 0

jobs:
  test-image-build:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
    - name: Checkout
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

    - name: Set up QEMU
      uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3
      with:
        buildkitd-flags: '--debug --allow-insecure-entitlement=network.host'
        driver-opts: network=host

    - name: Tailscale Connect
      uses: tailscale/github-action@4e4c49acaa9818630ce0bd7a564372c17e33fb4d # v2
      with:
        oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
        oauth-secret: ${{ secrets.TAILSCALE_OAUTH_SECRET }}
        tags: tag:github-action-ci-runner
        # renovate: datasource=github-releases depName=tailscale/tailscale
        version: "1.68.1"

    - name: Tailscale Debug
      if: ${{ (github.event.inputs.verbosity || env.default_verbosity) >= 1 }}
      shell: bash
      run: |
        sudo -E tailscale netcheck --verbose 2>&1 | sed -f .output-filter
        echo
        sudo -E tailscale status 2>&1 | sed -f .output-filter
        echo
        sudo -E tailscale status --json --peers=false 2>&1 | sed -f .output-filter
        echo

    - name: Login to container registry
      id: login
      uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3
      with:
        registry: ${{ secrets.CONTAINER_REGISTRY }}
        username: ${{ secrets.CONTAINER_REGISTRY_USERNAME }}
        password: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}

    - name: Docker meta
      id: meta
      uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
      with:
        images: |
          ${{ env.image_name }}
        labels: |
          org.opencontainers.image.title=Homelab-Workspace
          org.opencontainers.image.description=Coder workspace image
        tags: |
          type=ref,event=branch,enable=${{ github.ref_type != 'tag' }}
          type=ref,event=pr,enable=${{ github.ref_type != 'tag' }}
          type=raw,value={{sha}}
          type=raw,value=${{ github.run_id }}

    - name: Build image
      id: build
      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
      with:
        context: ./${{ env.image_path }}
        load: true
        pull: true
        push: false
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        annotations: ${{ steps.meta.outputs.annotations }}
        cache-from: type=registry,ref=${{ env.image_cache_name }}:${{ env.default_branch }}
        cache-to: type=inline
        build-args: |
          FETCH_GH_TOKEN=${{ secrets.GITHUB_TOKEN }}
        allow: network.host
        network: host

    - name: Test image
      id: test
      env:
        container_image: "${{ env.image_name }}:${{ github.run_id }}"
        container_name: "test_${{ github.run_id }}"
        test_user: tester
      shell: bash
      run: |
        echo "Show available images..."
        docker images
        echo

        echo "Starting container $container_name using image $container_image..."
        docker run -it -d --name $container_name --user 0:0 --entrypoint /bin/bash $container_image
        echo "Done"
        echo

        echo "Show running container..."
        docker ps -f name=$container_name
        echo "Done"
        echo

        echo "Running entrypoint preparation script..."
        docker exec $container_name sudo -u root /opt/coder/bin/entrypoint-prepare.sh --username $test_user
        echo "Done"
        echo

        echo "Running agent-startup script..."
        docker exec $container_name sudo -u $test_user /bin/bash --noprofile --norc /opt/coder/bin/agent-startup.sh
        echo "Done"
        echo

    - name: Tailscale Disconnect
      if: success() || failure()
      run: sudo -E tailscale logout