Adding Scanner Tool to Identify Problematic Docker Images

[james-crowley]

This is a Python based tool that allows user to scan all the images AdoptOpenJDK produces and identify any problematic Docker images.

This tool was made to help assist in issue #328.

Some highlights of this tool are allowing people to identify any missing images in DockerHub, identify bad manifests and identify if any images are not getting updated.

[james-crowley]

@karianna Thanks for adding @dinogun as a reviewer. It's a decently size Python file, if you or someone else wants to review as well, I think that would be best.

[dinogun]

@james-crowley First off, thank you for doing this. Adding a test suite for checking the validity of all the images is a very useful addition to the repo !

[dinogun]

In general, the PR looks good. A few minor comments interspersed below. Also I'd suggest that you rename 'scanner' as 'tests' folder as we are adding a bunch of tests to the Docker images.

Also can we add tests for the official images as well

[james-crowley]

Also I'd suggest that you rename 'scanner' as 'tests' folder as we are adding a bunch of tests to the Docker images.

@dinogun Did you want the folder structure to look like /tests/scanner/ or just put everything in /tests/?

[grzesuav]

@james-crowley maybe adding a information what kind of check scanner performs to scanner help command is a good idea.

As I understand it can : "to identify any missing images in DockerHub, identify bad manifests and identify if any images are not getting updated". So it is excepted to add it to CI build or use during local development ? From reading the README it checks already pushed images, right ?

[dinogun]

Also I'd suggest that you rename 'scanner' as 'tests' folder as we are adding a bunch of tests to the Docker images.

@dinogun Did you want the folder structure to look like /tests/scanner/ or just put everything in /tests/?

tests/scanner looks good.

[dinogun]

Also please rebase the PR to include the fix for the linter script.

[james-crowley]

So it is excepted to add it to CI build or use during local development ? From reading the README it checks already pushed images, right ?

@grzesuav This script could be used in a couple places. First use case would be having the script run as "cron" job in Jenkins every X hours/days. This should help you easily identify any issues with images/manifests.

Second use case would be integrating this into Adopt's CI/CD. After all your images/manifests have been built for nightly images, run this to verify everything got correctly published.

If you want to make a more manually approach, you can just run the script locally. If any issues raise then open a GitHub issue. That last couple issues I've open have been because this script caught errors in manifests and non-published images.

[karianna]

LGTM

[grzesuav]

So it is excepted to add it to CI build or use during local development ? From reading the README it checks already pushed images, right ?

@grzesuav This script could be used in a couple places. First use case would be having the script run as "cron" job in Jenkins every X hours/days. This should help you easily identify any issues with images/manifests.

Second use case would be integrating this into Adopt's CI/CD. After all your images/manifests have been built for nightly images, run this to verify everything got correctly published.

If you want to make a more manually approach, you can just run the script locally. If any issues raise then open a GitHub issue. That last couple issues I've open have been because this script caught errors in manifests and non-published images.

so actually we have two outstanding task(or maybe one ? ) - add it to CI pipeline /and/or/ cronjob ?

[james-crowley]

@grzesuav I added more information on what the checks each verification "stage" does. Hope this clears some stuff up for you.

@dinogun I added the --show-valid flag to show you the valid images like you requested. I also added a --json flag so you can get more output if needed.

Let me know what else is needed to get this PR merged.

[dinogun]

lgtm