30 lines
2.9 KiB
Markdown
30 lines
2.9 KiB
Markdown
# QA: Docker image publishing
|
|
|
|
Everything runs on the real local Docker daemon, with no registry push. On Windows use MSYS_NO_PATHCONV=1 under Git Bash and put the Docker bin on PATH (memory: docker-windows-gotchas).
|
|
|
|
## Automated / scripted
|
|
1. Refusals: run "task docker:publish" with REGISTRY_IMAGE empty, VERSION=dev, VERSION=2.9.0, and a dirty tree; assert non-zero exit and that no docker build started (compare "docker buildx ls" and the image list before and after).
|
|
2. Tag table: run "task docker:publish -- --dry-run" with VERSION=v2.9.0, v2.9.0-beta and v2.9.0-rc.1 (the VERSION override is accepted only with --dry-run); compare the printed tags with the feature.
|
|
3. Dry run: the image is loaded; "docker run --rm <image> --version" prints the tag; start the stack from docker.env.example and check GET /healthz is ok, and "docker exec <ctr> id -u" is not 0.
|
|
4. Secrets: "docker history --no-trunc" and a file search for .env and release.key inside the image are clean; grep the layers for the sample JWT_SECRET value.
|
|
5. Compose: "docker compose config" with and without RENEWCMS_IMAGE, and with the build override.
|
|
6. Upgrade simulation: tag two local images v-old and v-new, run the stack on v-old, write an article, switch RENEWCMS_IMAGE to v-new, "docker compose up -d", and verify the article and the new version.
|
|
7. Docs: grep the three docs for "docker compose pull", the tag scheme, and the absence of CI claims.
|
|
8. No credentials: grep Taskfile.yml and docs for token or password literals; the task must not call "docker login".
|
|
|
|
## Manual (user performs; needs the registry)
|
|
- `docker login git.floriansylvain.fr`; "task docker:publish" with a real tag; confirm "docker buildx imagetools inspect <image>:<tag>" lists linux/amd64 and linux/arm64.
|
|
- On a clean machine, "docker compose pull && docker compose up -d" against the pushed image; confirm /settings shows the new version and the container guidance from container_update_guidance.
|
|
- Confirm the moving "beta" tag points at the intended digest and that "latest" did not move for a prerelease.
|
|
|
|
## Results
|
|
- 1 Refusals: PASS (coder and hardener runs).
|
|
- 2 Tag table: PASS (v2.9.0, v2.9.0-beta, v2.9.0-rc.1; re-seen with v2.9.0-beta and v2.9.1-beta, tags "vX, X, beta").
|
|
- 3 Dry run: PASS (--version prints the tag, /healthz ok, uid 10001).
|
|
- 4 Secrets: PASS.
|
|
- 5 Compose: PASS.
|
|
- 6 Upgrade simulation: PASS. Local images v2.9.0-beta and v2.9.1-beta, stack on the old tag, register + verify (mail captured over TLS by Mailpit) + login, article created (201), RENEWCMS_IMAGE switched, "docker compose up -d" recreated the container on the same volume. Old cookie still accepted, login 200, article 1 intact, GET /v1/settings reports v2.9.1-beta (was v2.9.0-beta).
|
|
- 7 Docs: PASS.
|
|
- 8 No credentials: PASS.
|
|
- Manual items: NOT RUN (need the registry): docker login, real multi-arch push and imagetools inspect, "docker compose pull" against the pushed image, moving beta/latest tag checks, builder failure paths of a real run.
|