test-docker.yml

name: Test Docker Config

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  merge_group:

# Ensures that only one workflow task will run at a time. Previous builds, if
# already in process, will get cancelled. Only the latest commit will be allowed
# to run, cancelling any workflows in between
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  RUST_LIB_BACKTRACE: 1
  RUST_LOG: info
  COLORBT_SHOW_HIDDEN: 1

jobs:
  changes:
    # Docker validation runs on source PRs, not temporary Mergify queue candidates.
    if: >-
      ${{
        github.event_name != 'pull_request' ||
        github.event.pull_request.user.login != 'mergify[bot]' ||
        github.event.pull_request.head.repo.full_name != github.repository ||
        !startsWith(github.event.pull_request.head.ref, 'mergify/merge-queue/')
      }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      test_docker: ${{ steps.filter.outputs.test_docker || 'true' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: github.event_name == 'pull_request'
        with:
          persist-credentials: false
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        if: github.event_name == 'pull_request'
        with:
          filters: .github/path-filters.yml

  build-docker-image:
    name: Build Docker Image
    needs: changes
    if: needs.changes.outputs.test_docker == 'true'
    permissions:
      contents: read
      id-token: write
      statuses: write
    runs-on: ${{ vars.DOCKER_BUILD_RUNNER_AMD64 || 'ubuntu-latest' }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
      - name: Build & push
        id: docker_build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
        with:
          target: runtime
          context: .
          file: docker/Dockerfile
          tags: zebrad-runtime:${{ github.sha }}
          outputs: type=docker,dest=${{ runner.temp }}/zebrad-runtime.tar

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: zebrad-runtime
          path: ${{ runner.temp }}/zebrad-runtime.tar
          retention-days: 7

  test-configurations:
    name: Test ${{ matrix.name }}
    needs: [changes, build-docker-image]
    if: needs.changes.outputs.test_docker == 'true'
    permissions:
      contents: read
      actions: read
      checks: read
    runs-on: ${{ vars.DOCKER_BUILD_RUNNER_AMD64 || 'ubuntu-latest' }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          # Privilege drop verification - runs 'id' to verify non-root user
          - id: privilege-drop
            name: Privilege drop
            env_vars: ""
            test_cmd: id
            grep_patterns: -e "uid=10001\\(zebra\\).*gid=10001\\(zebra\\)"

          # Basic network configurations
          - id: default-conf
            name: Default config
            env_vars: ""
            grep_patterns: -e "resolved seed peer IP addresses.*mainnet"

          - id: testnet-conf
            name: Testnet config
            env_vars: -e ZEBRA_NETWORK__NETWORK=Testnet
            grep_patterns: -e "resolved seed peer IP addresses.*testnet"

          # Bind-mounts the repo's config file into the runtime image, which does not bake it in.
          - id: custom-conf
            name: Custom config
            env_vars: -v $GITHUB_WORKSPACE/zebrad/tests/common/configs/custom-conf.toml:/tmp/custom-conf.toml:ro -e CONFIG_FILE_PATH=/tmp/custom-conf.toml
            grep_patterns: -e "extra_coinbase_data:\\sSome\\(ExtraCoinbaseData\\(\\\"Do you even shield\\?\\\"\\)\\)"

          # RPC configuration tests
          - id: rpc-conf
            name: RPC config
            env_vars: -e ZEBRA_RPC__LISTEN_ADDR=0.0.0.0:8232
            grep_patterns: -e "Opened RPC endpoint at.*0.0.0.0:8232"

          - id: rpc-custom-conf
            name: RPC with custom port
            env_vars: -e ZEBRA_RPC__LISTEN_ADDR=127.0.0.1:28232
            grep_patterns: -e "Opened RPC endpoint at.*127.0.0.1:28232"

          # Custom directory tests
          - id: rpc-cookie-conf
            name: RPC with custom cookie dir
            env_vars: -e ZEBRA_RPC__LISTEN_ADDR=0.0.0.0:8232 -e ZEBRA_RPC__ENABLE_COOKIE_AUTH=true -e ZEBRA_RPC__COOKIE_DIR=/home/zebra/.config/cookie
            grep_patterns: -e "RPC auth cookie written to disk"

          # Custom directory tests
          - id: custom-dirs-conf
            name: Custom cache and cookie directories
            env_vars: -e ZEBRA_STATE__CACHE_DIR=/tmp/zebra-cache
            grep_patterns: -e "Opened Zebra state cache at /tmp/zebra-cache"

          # Feature-based configurations
          - id: prometheus-feature
            name: Prometheus metrics
            env_vars: -e ZEBRA_METRICS__ENDPOINT_ADDR=0.0.0.0:9999
            grep_patterns: -e "0.0.0.0:9999"

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
        with:
          persist-credentials: false

      - name: Download artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: zebrad-runtime
          path: ${{ runner.temp }}

      - name: Load image
        run: |
          docker load --input ${{ runner.temp }}/zebrad-runtime.tar
          docker image ls -a

      - name: Run ${{ matrix.name }} test
        env:
          TEST_CMD: ${{ matrix.test_cmd }}
        run: |
          # For one-shot commands (like 'id'), run directly and check output
          if [ -n "$TEST_CMD" ]; then
            OUTPUT=$(docker run --rm ${{ matrix.env_vars }} zebrad-runtime:${{ github.sha }} $TEST_CMD)
            echo "Output: $OUTPUT"
            if echo "$OUTPUT" | grep --extended-regexp ${{ matrix.grep_patterns }}; then
              echo "SUCCESS: Found expected pattern in output"
              exit 0
            else
              echo "FAILURE: Expected pattern not found in output"
              exit 1
            fi
          fi

          # For long-running commands (zebrad start), run detached and follow logs
          docker run ${{ matrix.env_vars }} --detach --name ${{ matrix.id }} -t zebrad-runtime:${{ github.sha }} zebrad start
          # Use a subshell to handle the broken pipe error gracefully
          (
            trap "" PIPE;
            docker logs \
            --tail all \
            --follow \
            ${{ matrix.id }} | \
            tee --output-error=exit /dev/stderr | \
            grep --max-count=1 --extended-regexp --color=always \
            ${{ matrix.grep_patterns }}
          )
          LOGS_EXIT_STATUS=$?

          # Display grep status for debugging
          echo "grep exit status: $LOGS_EXIT_STATUS"

          docker stop ${{ matrix.id }}

          EXIT_STATUS=$(docker wait ${{ matrix.id }} || echo "Error retrieving exit status");
          echo "docker exit status: $EXIT_STATUS";

          # If grep didn't find the pattern, fail immediately
          if [ $LOGS_EXIT_STATUS -ne 0 ]; then
              echo "ERROR: Failed to find the expected pattern in logs. Check grep_patterns.";
              exit 1;
          else
            echo "SUCCESS: Found the expected pattern in logs.";
            # Exit successfully if grep passed, even if docker stop resulted in SIGKILL (137 or 139)
            exit 0;
          fi

  test-docker:
    runs-on: ubuntu-latest
    if: always() && needs.changes.result != 'skipped'
    needs:
      - changes
      - build-docker-image
      - test-configurations
    timeout-minutes: 30
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe #v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}
          allowed-skips: build-docker-image, test-configurations