add smoke test + gated ci

Author: MarvAmBass

.github/workflows/docker-publish.yml

@@ -21,10 +21,21 @@ env:
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
+  IMAGE_PLATFORMS: linux/amd64,linux/arm64,linux/arm/v7
 
 
 jobs:
+  # gate: don't build or publish anything unless the tests pass
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Run tests
+        run: ./test.sh
+
   build:
+    needs: test
 
     runs-on: ubuntu-latest
     permissions:
@@ -36,20 +47,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3.5.0
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          platforms: ${{ env.IMAGE_PLATFORMS }}
+
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -59,12 +75,16 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Extract Docker Version Tag
-        id: docker_version_tag          
+        id: docker_version_tag
+        env:
+          # rebuild on code changes (push / manual run); only the nightly
+          # schedule dedups on the version tag to skip identical rebuilds
+          FORCE_REBUILD: ${{ github.event_name != 'schedule' && '1' || '' }}
         run: |
           ./get-version.sh $(echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:" | tr '[:upper:]' '[:lower:]') | sed 's/^/tag=/g' >> $GITHUB_OUTPUT
 
@@ -77,12 +97,12 @@ jobs:
       - name: Build and push Docker image with tag
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
         id: build-and-push-tagged
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_version_tag.outputs.tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: ${{ env.IMAGE_PLATFORMS }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -100,7 +120,7 @@ jobs:
 
       - name: Build Docker Latest Tag
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
-        id: docker_latest_tag          
+        id: docker_latest_tag
         run: |
           echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" | tr '[:upper:]' '[:lower:]' >> $GITHUB_OUTPUT
 
@@ -109,12 +129,12 @@ jobs:
       - name: Build and push Docker image as latest
         if: ${{ !endsWith(steps.docker_version_tag.outputs.tag, 'latest') }}
         id: build-and-push-latest
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.docker_latest_tag.outputs.tag }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: ${{ env.IMAGE_PLATFORMS }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/test.yml

@@ -0,0 +1,15 @@
+name: Test
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Run smoke tests
+        run: ./test.sh

build.sh

@@ -3,7 +3,7 @@
 [ -z "$DOCKER_REGISTRY" ] && echo "error please specify docker-registry DOCKER_REGISTRY" && exit 1
 IMG="$DOCKER_REGISTRY/$(basename $(cat .git/config | tr ' ' '\n' | grep github.com))"
 
-PLATFORM="linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6"
+PLATFORM="linux/amd64,linux/arm64,linux/arm/v7"
 
 TAG=$(./get-version.sh)
 

get-version.sh

@@ -7,6 +7,14 @@ export PHPMYADMIN_VERSION=$(docker run --rm -t get-version ls /var/www/html/phpm
 [ -z "$DEBIAN_VERSION" ] && exit 1
 
 export IMGTAG=$(echo "$1""d$DEBIAN_VERSION-a$APACHE_VERSION-p$PHPMYADMIN_VERSION")
+# FORCE_REBUILD (set by the workflow for push / manual runs) rebuilds even if
+# the versioned image already exists, so code/config changes get republished.
+# the nightly schedule leaves it unset and keeps deduping on the version tag.
+if [ -n "$FORCE_REBUILD" ]; then
+  echo "$IMGTAG"
+  exit 0
+fi
+
 export IMAGE_EXISTS=$(docker pull "$IMGTAG" 2>/dev/null >/dev/null; echo $?)
 
 # return latest, if container is already available :)

test.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# Automated smoke test for the phpmyadmin container.
+# Builds the image, runs it, waits for apache to come up on port 80 and
+# asserts that the phpMyAdmin app page actually renders (not just apache).
+set -e
+
+IMG=phpmyadmin-test
+CN=phpmyadmin-test-run
+
+cleanup() { docker rm -f "$CN" >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+fail() { echo "FAIL: $1"; exit 1; }
+
+# raw HTTP GET over bash /dev/tcp (base image has neither wget nor curl)
+http_get() {
+  docker exec "$CN" bash -c '
+    p="$1"
+    exec 3<>/dev/tcp/127.0.0.1/80
+    printf "GET %s HTTP/1.0\r\nHost: localhost\r\n\r\n" "$p" >&3
+    cat <&3
+  ' _ "$1"
+}
+
+echo ">> building image"
+docker build -t "$IMG" .
+
+echo ">> starting container"
+docker rm -f "$CN" >/dev/null 2>&1 || true
+docker run -d --name "$CN" \
+  -e DISABLE_TLS=disable \
+  -e SECRET=testblowfishsecret0123456789abcd \
+  "$IMG" >/dev/null
+
+echo ">> waiting for apache to listen on 80 (up to 120s)"
+up=0
+for _ in $(seq 1 60); do
+  if docker exec "$CN" bash -c 'exec 3<>/dev/tcp/127.0.0.1/80' 2>/dev/null; then up=1; break; fi
+  sleep 2
+done
+[ "$up" = 1 ] || fail "apache did not start listening on 80 in time"
+
+echo ">> assert: container is running"
+[ "$(docker inspect -f '{{.State.Running}}' "$CN")" = true ] || fail "container not running"
+echo "ok - container running"
+
+echo ">> assert: HTTP GET / returns a status line"
+status=$(http_get / | head -1 | tr -d '\r')
+echo "$status" | grep -q '^HTTP/' || fail "no HTTP status line (got: $status)"
+echo "ok - status line: $status"
+
+echo ">> assert: served HTML contains phpMyAdmin"
+http_get /phpmyadmin/ | grep -q 'phpMyAdmin' || fail "phpMyAdmin app page did not render"
+echo "ok - phpMyAdmin page rendered"
+
+echo ">> assert: no PHP Fatal in apache error log"
+docker exec "$CN" tail -n 200 /var/log/apache2/error.log 2>/dev/null | grep -i 'PHP Fatal' \
+  && fail "PHP Fatal error found in apache error log" || true
+echo "ok - no PHP Fatal in error log"
+
+echo ""
+echo "ALL TESTS PASSED"