add test.sh + gated ci, modernize workflow

Author: MarvAmBass

.github/workflows/docker-publish.yml

@@ -21,10 +21,21 @@ env:
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
+  IMAGE_PLATFORMS: linux/amd64,linux/arm64,linux/arm/v7
 
 
 jobs:
+  # gate: don't build or publish anything unless the tests pass
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Run tests
+        run: ./test.sh
+
   build:
+    needs: test
 
     runs-on: ubuntu-latest
     permissions:
@@ -36,20 +47,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3.5.0
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          platforms: ${{ env.IMAGE_PLATFORMS }}
+
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -59,12 +75,16 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Extract Docker Version Tag
-        id: docker_version_tag          
+        id: docker_version_tag
+        env:
+          # rebuild on code changes (push / manual run); only the nightly
+          # schedule dedups on the version tag to skip identical rebuilds
+          FORCE_REBUILD: ${{ github.event_name != 'schedule' && '1' || '' }}
         run: |
           ./get-version.sh $(echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:" | tr '[:upper:]' '[:lower:]') | sed 's/^/tag=/g' >> $GITHUB_OUTPUT
 
@@ -77,12 +97,12 @@ jobs:
       - name: Build and push Docker image with tag
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
         id: build-and-push-tagged
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_version_tag.outputs.tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: ${{ env.IMAGE_PLATFORMS }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -100,7 +120,7 @@ jobs:
 
       - name: Build Docker Latest Tag
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
-        id: docker_latest_tag          
+        id: docker_latest_tag
         run: |
           echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" | tr '[:upper:]' '[:lower:]' >> $GITHUB_OUTPUT
 
@@ -109,12 +129,12 @@ jobs:
       - name: Build and push Docker image as latest
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
         id: build-and-push-latest
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_latest_tag.outputs.tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: ${{ env.IMAGE_PLATFORMS }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/test.yml

@@ -0,0 +1,15 @@
+name: Test
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Run smoke tests
+        run: ./test.sh

build.sh

@@ -3,7 +3,7 @@
 [ -z "$DOCKER_REGISTRY" ] && echo "error please specify docker-registry DOCKER_REGISTRY" && exit 1
 IMG="$DOCKER_REGISTRY/$(basename $(cat .git/config | tr ' ' '\n' | grep github.com))"
 
-PLATFORM="linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6"
+PLATFORM="linux/amd64,linux/arm64,linux/arm/v7"
 
 TAG=$(./get-version.sh)
 

get-version.sh

@@ -6,6 +6,14 @@ export APACHE_VERSION=$(docker run --rm -t get-version dpkg --list apache2 | gre
 [ -z "$DEBIAN_VERSION" ] && exit 1
 
 export IMGTAG=$(echo "$1""d$DEBIAN_VERSION-a$APACHE_VERSION")
+# FORCE_REBUILD (set by the workflow for push / manual runs) rebuilds even if
+# the versioned image already exists, so code/config changes get republished.
+# the nightly schedule leaves it unset and keeps deduping on the version tag.
+if [ -n "$FORCE_REBUILD" ]; then
+  echo "$IMGTAG"
+  exit 0
+fi
+
 export IMAGE_EXISTS=$(docker pull "$IMGTAG" 2>/dev/null >/dev/null; echo $?)
 
 # return latest, if container is already available :)

test.sh

@@ -0,0 +1,62 @@
+#!/bin/sh
+# Automated smoke test for the apache2-ssl-secure container.
+# Builds the image, runs it (the entrypoint auto-generates a self-signed cert),
+# waits for apache to listen on 80 and asserts that the apache config is valid,
+# that HTTP serves a response and that PHP actually executes.
+set -e
+
+IMG=apache2-ssl-secure-test
+CN=apache2-ssl-secure-test-run
+
+cleanup() { docker rm -f "$CN" >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+fail() { echo "FAIL: $1"; exit 1; }
+
+# HTTP GET over bash /dev/tcp (the image ships neither wget nor curl, but bash
+# is present as the entrypoint interpreter). $1 = path, prints the raw response.
+http_get() {
+  docker exec "$CN" bash -c '
+    exec 3<>/dev/tcp/127.0.0.1/80 || exit 1
+    printf "GET %s HTTP/1.0\r\nHost: localhost\r\n\r\n" "'"$1"'" >&3
+    cat <&3
+  '
+}
+
+echo ">> building image"
+docker build -t "$IMG" .
+
+echo ">> starting container"
+docker rm -f "$CN" >/dev/null 2>&1 || true
+docker run -d --name "$CN" "$IMG" >/dev/null
+
+echo ">> waiting for apache to listen on 80 (up to 120s)"
+up=0
+for _ in $(seq 1 60); do
+  if docker exec "$CN" bash -c 'exec 3<>/dev/tcp/127.0.0.1/80' 2>/dev/null; then up=1; break; fi
+  sleep 2
+done
+[ "$up" = 1 ] || fail "apache did not start listening on 80 in time"
+
+echo ">> assert: container is running"
+[ "$(docker inspect -f '{{.State.Running}}' "$CN")" = true ] || fail "container not running"
+echo "ok - container running"
+
+echo ">> assert: apache2ctl -t reports Syntax OK"
+syntax=$(docker exec "$CN" apache2ctl -t 2>&1 || true)
+echo "$syntax" | grep -q 'Syntax OK' || fail "apache config not valid (got: $syntax)"
+echo "ok - apache2ctl -t: Syntax OK"
+
+echo ">> assert: HTTP request on port 80 returns a response"
+resp=$(http_get /) || fail "no HTTP response on port 80"
+echo "$resp" | grep -q '^HTTP/' || fail "no HTTP status line (got: $(echo "$resp" | head -1))"
+echo "ok - HTTP responded: $(echo "$resp" | head -1 | tr -d '\r')"
+
+echo ">> assert: PHP executes"
+docker exec "$CN" bash -c "printf '%s' \"<?php echo 'PHPOK:'.PHP_VERSION;\" > /var/www/html/phptest.php"
+body=$(http_get /phptest.php)
+echo "$body" | grep -q 'PHPOK:8\.' || fail "PHP did not execute as expected (got: $body)"
+echo "ok - PHP executed: $(echo "$body" | grep -o 'PHPOK:8\.[0-9.]*')"
+
+echo ""
+echo "ALL TESTS PASSED"