ci_common.yml

#
# This workflow contains the core logic to build, test and release the GitHub Action and Azure DevOps Task
# It is called via workflow_call from the pr-bot
#
name: "build-test"
on:
  workflow_call:
    inputs:
      prNumber:
        description: The PR number (if building for a PR)
        type: string
        required: false
      prRef:
        description: The git ref to checkout (e.g. the merge commit for a PR)
        type: string
        required: false
      prHeadSha:
        description: >-
          For PR builds (where GITHUB_REF would usually be set to the PR but isn't due to the pr-bot 
          running on a comment trigger), pass the PR's head SHA commit here
        type: string
        required: false
      runFullTests:
        description: true to run the full tests, false to run tests without credentials
        default: true
        type: boolean
        required: false
      release:
        type: boolean
        description: indicates whether to make a release
        default: false
        required: false
      AZDO_ORG:
        description: The AzDO org for AzDO task verification
        type: string
        required: false
        default: https://dev.azure.com/monacotools
      AZDO_PROJECT:
        description: The AzDO project for AzDO task verification
        type: string
        required: false
        default: Monaco
      AZDO_BUILD:
        description: The AzDO build to trigger for AzDO task verification
        type: string
        required: false
        default: devcontainers.ci
    secrets:
      AZDO_TOKEN:
        description: ""
        required: true

permissions:
  contents: write
  packages: write
  pull-requests: write
  checks: write

jobs:
  build: # run build using the github action!
    runs-on: ubuntu-latest
    name: build, test, package
    outputs:
      version: ${{ steps.build.outputs.version }}
      version_short: ${{ steps.build.outputs.version_short }}
      version_major: ${{ steps.build.outputs.version_major }}
      image_tag: ${{ steps.set_image_tag.outputs.image_tag }}
      image_push_option: ${{ steps.set_image_push_option.outputs.image_push_option }}
      build_number: ${{ steps.build_number.outputs.build_number }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - id: set_image_push_option
        name: Set image push option
        uses: actions/github-script@v6
        with:
          script: |
            // if running full tests then use the filter option, for the dev container action
            // else, set to never to avoid pushing (as we're likely running without secrets)

            const pushOption = ${{ inputs.runFullTests }} ? 'filter' : 'never';
            console.log(`Setting image_push_option=${pushOption}`);
            core.setOutput("image_push_option", pushOption);

      - name: Login to GitHub Container Registry
        if: ${{ steps.set_image_push_option.outputs.image_push_option == 'filter' }}
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Previously, run_id was used as the patch number (BUILD_NUMBER)
      # but this got outside the limit for AzDO extensions (0 to 2147483647)
      - name: Generate build number
        id: build_number
        # only run this if we are going to run the AzDO publishing
        if: ${{ steps.set_image_push_option.outputs.image_push_option == 'filter' }}
        uses: onyxmueller/build-tag-number@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - id: set_image_tag
        name: Set image_tag...
        uses: actions/github-script@v6
        env:
          PR_NUMBER: ${{ inputs.prNumber }}
        with:
          script: |
            const {PR_NUMBER} = process.env
            if (PR_NUMBER) {
              const prTag = `pr-${PR_NUMBER}`;
              console.log(`Setting image_tag=${prTag} for pull_request`);
              core.setOutput("image_tag", prTag);
              return;
            }
            if ((context.eventName === "push" || context.eventName === "workflow_dispatch") && context.ref === "refs/heads/main") {
              console.log("Setting image_tag=latest for push to main");
              core.setOutput("image_tag", "latest");
              return;
            }
            core.error('Failed to set image_tag');
            console.log(context);

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          node --version
          npm --version
          echo "** Installing and building common..."
          (cd common && npm install && npm run build)
          (cd common && npm run tsc_version)
          echo "** Installing and building github-action..."
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Build in dev container
        uses: ./
        id: build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUILD_NUMBER: ${{ steps.build_number.outputs.build_number }}
          IS_PR: ${{ github.head_ref }}
          BRANCH: ${{ github.ref }}
        with:
          imageName: ghcr.io/devcontainers/ci-devcontainer
          imageTag: ${{ steps.set_image_tag.outputs.image_tag }}
          runCmd: |
            echo "Starting"
            ./scripts/build-test-package.sh
          push: ${{ steps.set_image_push_option.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request
          env: |
            BUILD_NUMBER
            IS_CI=1
            IS_PR
            BRANCH

      - name: Show version info
        env:
          VERSION: ${{ steps.build.outputs.version }}
          VERSION_SHORT: ${{ steps.build.outputs.version_short }}
          VERSION_MAJOR: ${{ steps.build.outputs.version_major }}
        run: |
          echo "VERSION=${VERSION}"
          echo "VERSION_SHORT=${VERSION_SHORT}"
          echo "VERSION_MAJOR=${VERSION_MAJOR}"

      - uses: actions/upload-artifact@v3
        name: Create dev AzDO VSIX artifact
        with:
          name: azdo-task-dev
          path: ./output/devcontainers-dev.ci-${{ steps.build.outputs.version }}.vsix
          if-no-files-found: error

      - uses: actions/upload-artifact@v3
        name: Create release AzDO VSIX artifact
        with:
          name: azdo-task
          path: ./output/devcontainers.ci-${{ steps.build.outputs.version }}.vsix
          if-no-files-found: error

  checks-succeeded:
    # simple no-op job to use as step for check status
    name: All succeeded
    needs: # TODO - check what jobs need adding here
      - build
      - test-azdo
      - test-gh-run-args
      - test-gh-build-args
      - test-gh-dockerfile-context
      - test-gh-feature-docker-from-docker
      - test-gh-docker-from-docker-non-root
      - test-gh-docker-from-docker-root
      - test-gh-skip-user-update
      - test-compose-features
      - test-config-file
      - test-simple
      - test-no-run
      - test-platform-with-runcmd
      - test-env-vars-on-post-create
      - test-multiple-tags-job2
      - test-github-output
    runs-on: ubuntu-latest
    steps:
      - name: Simple step
        run: |
          echo Done!

  pr-checks:
    name: Mark PR checks as complete
    needs: # TODO - check what jobs need adding here
      - checks-succeeded
    runs-on: ubuntu-latest
    if: ${{ inputs.prHeadSha }}
    steps:
      # For PR builds triggered from comment builds, the GITHUB_REF is set to main
      # so the checks aren't automatically associated with the PR
      # If prHeadSha is specified then explicity mark the checks for that SHA
      - name: Report check status
        if: ${{ inputs.prHeadSha }}
        uses: LouisBrunner/checks-action@v1.6.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # the name must be identical to the one received by the real job
          sha: ${{ inputs.prHeadSha }}
          name: "Build, test, publish / All succeeded"
          status: "completed"
          conclusion: "success"

  release:
    name: Create release
    runs-on: ubuntu-latest
    needs:
      - build
      - checks-succeeded
    if: ${{ inputs.release == true }}
    env:
      VERSION: ${{ needs.build.outputs.version }}
      VERSION_SHORT: ${{ needs.build.outputs.version_short }}
      VERSION_MAJOR: ${{ needs.build.outputs.version_major }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Show version info
        run: |
          echo "VERSION=${VERSION}"
          echo "VERSION_SHORT=${VERSION_SHORT}"
          echo "VERSION_MAJOR=${VERSION_MAJOR}"

      - name: Download release VSIX
        uses: actions/download-artifact@v3
        with:
          name: azdo-task
          path: output

      - name: Show version
        run: |
          echo "VERSION: $VERSION"
          echo "VERSION_SHORT: $VERSION_SHORT"

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: github.ref == 'refs/heads/main' # only need this for push (on `main`)
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Publish AzDO Task
        uses: ./
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AZDO_PROJECT: ${{ inputs.AZDO_PROJECT }}
          AZDO_BUILD: ${{ inputs.AZDO_BUILD }}
          AZDO_ORG: ${{ inputs.AZDO_ORG }}
          AZDO_TOKEN: ${{ secrets.AZDO_TOKEN }}
          AZURE_DEVOPS_EXT_PAT: ${{ secrets.AZDO_TOKEN }}
          BUILD_NUMBER: ${{ github.run_id }}
          IS_PR: ${{ github.head_ref }}
          BRANCH: ${{ github.ref }}
        with:
          imageName: ghcr.io/devcontainers/ci-devcontainer
          runCmd: |
            echo "Starting"
            ./scripts/publish-azdo-task.sh
          env: |
            BUILD_NUMBER
            IS_CI=1
            IS_PR
            BRANCH
            AZDO_TOKEN
            AZURE_DEVOPS_EXT_PAT
            AZDO_ORG
            AZDO_PROJECT
            AZDO_BUILD

      - name: Create GitHub Action Release
        env:
          TAG_NAME: v${{ needs.build.outputs.version_short }}
          RELEASE_NAME: v${{ needs.build.outputs.version }}
          GH_TOKEN: ${{ github.token }}
        run: |
          git config user.name "CI build"
          git config user.email automated-build@example.com

          ./scripts/gh-release.sh

  #
  # Jobs to test
  #
  # When adding a new test:
  # - add to the 'needs' section for the 'checks-succeeded' job
  # - add any new images to the image_names in clean_tags.sh
  # - review the Azure DevOps pipeline and consider adding there for verification
  #

  test-azdo:
    name: Run AzDO test
    runs-on: ubuntu-latest
    needs: build
    if: ${{ needs.build.outputs.image_push_option == 'filter' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Show version
        env:
          VERSION: ${{ needs.build.outputs.version }}
          VERSION_SHORT: ${{ needs.build.outputs.version_short }}
        run: |
          echo "VERSION: $VERSION"
          echo "VERSION_SHORT: $VERSION_SHORT"

      - name: Download workflow artifacts
        uses: actions/download-artifact@v3
        with:
          path: output

      - name: Download release VSIX
        uses: actions/download-artifact@v3
        with:
          name: azdo-task-dev
          path: output

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: github.ref == 'refs/heads/main' # only need this for push (on `main`)
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run AzDO test pipeline
        uses: ./
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AZDO_PROJECT: ${{ inputs.AZDO_PROJECT }}
          AZDO_BUILD: ${{ inputs.AZDO_BUILD }}
          AZDO_ORG: ${{ inputs.AZDO_ORG }}
          AZDO_TOKEN: ${{ secrets.AZDO_TOKEN }}
          AZURE_DEVOPS_EXT_PAT: ${{ secrets.AZDO_TOKEN }}
          BUILD_NUMBER: ${{ github.run_id }}
          IS_PR: ${{ github.head_ref }}
          BRANCH: ${{ github.ref }}
          IMAGE_TAG: ${{ needs.build.outputs.image_tag }}
        with:
          imageName: ghcr.io/devcontainers/ci-devcontainer
          runCmd: |
            echo "Starting"
            ./scripts/test-azdo.sh
          env: |
            BUILD_NUMBER
            IMAGE_TAG
            IS_CI=1
            IS_PR
            BRANCH
            AZDO_TOKEN
            AZURE_DEVOPS_EXT_PAT
            AZDO_ORG
            AZDO_PROJECT
            AZDO_BUILD

  test-simple:
    name: Run simple test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        id: simpletest
        with:
          subFolder: github-tests/Dockerfile/run-args
          runCmd: echo $HOSTNAME && [[ $HOSTNAME == "my-host" ]]
      - name: Validate runCmdOutput output
        run: |
          echo "'runCmdOutput' value: $runCmdOutput"
          if [["$runCmdOutput" = *my-host*]]; then
            echo "'runCmdOutput' output of simpletest step doesn't contain expected value 'my-host'"
            exit 1
          fi
        env:
          runCmdOutput: ${{ steps.simpletest.outputs.runCmdOutput }}

  test-config-file:
    name: Run test with config file
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        id: configfiletest
        with:
          subFolder: github-tests/Dockerfile/config-file
          configFile: github-tests/Dockerfile/config-file/.devcontainer/subfolder/devcontainer.json
          runCmd: echo $HOSTNAME && [[ $HOSTNAME == "my-host" ]]
      - name: Validate runCmdOutput output
        run: |
          echo "'runCmdOutput' value: $runCmdOutput"
          if [["$runCmdOutput" = *my-host*]]; then
            echo "'runCmdOutput' output of configfiletest step doesn't contain expected value 'my-host'"
            exit 1
          fi
        env:
          runCmdOutput: ${{ steps.configfiletest.outputs.runCmdOutput }}

  test-gh-run-args:
    name: Run GitHub run-args test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/run-args
          imageName: ghcr.io/devcontainers/ci/tests/run-args
          runCmd: echo $HOSTNAME && [[ $HOSTNAME == "my-host" ]]
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-env-vars-on-post-create:
    name: Run GitHub env-vars-on-post-create test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        env: # TEST_ENV_VALUE1 is set via devcontainer.json using a localEnv reference
          TEST_ENV_VALUE1: SetViaDevcontainerJsonLocalEnv
        with:
          subFolder: github-tests/Dockerfile/env-vars-on-post-create
          imageName: ghcr.io/devcontainers/ci/tests/env-vars-on-post-create
          env:
            | # TEST_ENV_VALUE2 is an additional env var to pass to the container
            TEST_ENV_VALUE2=AdditionalEnvVar
          runCmd: |
            cat marker.txt
            cat marker.txt | grep 'post-create: TEST_ENV_VALUE1=SetViaDevcontainerJsonLocalEnv'
            cat marker.txt | grep 'post-create: TEST_ENV_VALUE2=AdditionalEnvVar'
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-gh-build-args:
    name: Run GitHub build-args test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/build-args
          imageName: ghcr.io/devcontainers/ci/tests/build-args
          runCmd: echo $BUILD_ARG_TEST && [[ $BUILD_ARG_TEST == "Hello build-args!" ]]
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-gh-dockerfile-context:
    name: Run GitHub dockerfile-context test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/dockerfile-context
          imageName: ghcr.io/devcontainers/ci/tests/dockerfile-context
          runCmd: /tmp/dummy.sh
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-gh-feature-docker-from-docker:
    name: Run GitHub feature-docker-from-docker test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/feature-docker-from-docker
          imageName: ghcr.io/devcontainers/ci/tests/feature-docker-from-docker
          runCmd: make docker-build
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-gh-docker-from-docker-non-root:
    name: Run GitHub docker-from-docker-non-root test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/docker-from-docker-non-root
          imageName: ghcr.io/devcontainers/ci/tests/docker-from-docker-non-root
          runCmd: make docker-build
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-gh-docker-from-docker-root:
    name: Run GitHub docker-from-docker-root test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/docker-from-docker-root
          imageName: ghcr.io/devcontainers/ci/tests/docker-from-docker-root
          runCmd: make docker-build
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-gh-skip-user-update:
    name: Run GitHub skipContainerUserIdUpdate test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/skip-user-update
          imageName: ghcr.io/devcontainers/ci/tests/skip-user-update
          skipContainerUserIdUpdate: true
          runCmd: |
            echo "Get user/group info ..."
            user_id=$(id -u $(whoami))
            echo "User ID: $user_id"
            group_id=$(id -g $(whoami))
            echo "Group ID: $group_id"
            [[ $user_id == 1000 ]] && [[ $group_id == 1000 ]]
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-compose-features:
    name: Run GitHub docker-compose with features test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/docker-compose/features
          imageName: ghcr.io/devcontainers/ci/tests/compose-features
          runCmd: go version
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request

  test-no-run:
    name: Run test without runCmd
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/build-only

  test-platform-with-runcmd:
    name: Run GitHub platform and runCmd test
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up QEMU for multi-architecture builds
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # This can be omitted once runner images have a version of Skopeo > 1.4.1
      # See https://github.com/containers/skopeo/issues/1874 (and https://github.com/devcontainers/ci/issues/191#issuecomment-1416384710)
      - name: Update skopeo
        run: |
          sudo apt purge buildah golang-github-containers-common podman skopeo
          sudo apt autoremove --purge
          REPO_URL="https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/unstable"
          source /etc/os-release
          sudo sh -c "echo 'deb ${REPO_URL}/x${NAME}_${VERSION_ID}/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:unstable.list"
          sudo wget -qnv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/x${NAME}_${VERSION_ID}/Release.key -O Release.key
          sudo apt-key add Release.key
          sudo apt-get update
          sudo apt-get install skopeo

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Run test
        uses: ./
        id: platform-with-runcmd
        with:
          subFolder: github-tests/Dockerfile/platform-with-runcmd
          imageName: ghcr.io/devcontainers/ci/tests/platform-with-runcmd
          platform: linux/amd64,linux/arm64
          runCmd: echo $HOSTNAME && [[ $HOSTNAME == "my-host" ]]
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request
      - name: Validate runCmdOutput output
        run: |
          echo "'runCmdOutput' value: $runCmdOutput"
          if [["$runCmdOutput" = *my-host*]]; then
            echo "'runCmdOutput' output of platform-with-runcmd step doesn't contain expected value 'my-host'"
            exit 1
          fi
        env:
          runCmdOutput: ${{ steps.platform-with-runcmd.outputs.runCmdOutput }}

  test-multiple-tags-job1:
    # This is split into multiple parts because pushing the image happens during the post-job phase
    # and thus testing if the tags exist can't happen as part of job 1
    name: Test multiple tags job 1
    runs-on: ubuntu-latest
    needs: build
    if: ${{ needs.build.outputs.image_push_option == 'filter' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Build and push with multiple tags and single platform
        uses: ./
        id: multiple-tags-single-platform
        with:
          subFolder: github-tests/Dockerfile/build-only
          imageName: ghcr.io/devcontainers/ci/tests/multiple-tags-single-platform
          imageTag: tag1-${{ github.run_id }},tag2-${{ github.run_id }}
          push: always

      - name: Set up QEMU for multi-architecture builds
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Install updated Skopeo
        # This can be omitted once runner images have a version of Skopeo > 1.4.1
        # See https://github.com/containers/skopeo/issues/1874
        run: |
          sudo apt purge buildah golang-github-containers-common podman skopeo
          sudo apt autoremove --purge
          REPO_URL="https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/unstable"
          source /etc/os-release
          sudo sh -c "echo 'deb ${REPO_URL}/x${NAME}_${VERSION_ID}/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:unstable.list"
          sudo wget -qnv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/x${NAME}_${VERSION_ID}/Release.key -O Release.key
          sudo apt-key add Release.key
          sudo apt-get update
          sudo apt-get install skopeo

      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)

      - name: Build and push with multiple tags and multiple platforms
        uses: ./
        id: multiple-tags-multiple-platforms
        with:
          subFolder: github-tests/Dockerfile/platform-with-runcmd
          imageName: ghcr.io/devcontainers/ci/tests/multiple-tags-multiple-platforms
          imageTag: tag1-${{ github.run_id }},tag2-${{ github.run_id }}
          platform: linux/amd64,linux/arm64
          push: always

  test-multiple-tags-job2:
    name: Test multiple tags job 2
    runs-on: ubuntu-latest
    needs: [build, test-multiple-tags-job1]
    steps:
      - name: Validate multiple tags single platform
        run: |
          set -e
          echo "Querying GitHub API for versions of package devcontainers-ci/tests/multiple-tags-single-platform..."
          versions=$(curl -s -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/users/devcontainers/packages/container/ci%2Ftests%2Fmultiple-tags-single-platform/versions)
          echo "Checking tag1-${{ github.run_id }} exists... "
          echo "$versions" | grep -q "tag1-${{ github.run_id }}"
          echo "Tag exists."
          echo "Checking tag2-${{ github.run_id }} exists... "
          echo "$versions" | grep -q "tag1-${{ github.run_id }}"
          echo "Tag exists."
      - name: Validate multiple tags multiple platforms
        run: |
          set -e
          echo "Querying GitHub API for versions of package devcontainers-ci/tests/multiple-tags-multiple-platforms..."
          versions=$(curl -s -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/users/devcontainers/packages/container/ci%2Ftests%2Fmultiple-tags-multiple-platforms/versions)
          echo "Checking tag1-${{ github.run_id }} exists... "
          echo "$versions" | grep -q "tag1-${{ github.run_id }}"
          echo "Tag exists."
          echo "Checking tag2-${{ github.run_id }} exists... "
          echo "$versions" | grep -q "tag1-${{ github.run_id }}"
          echo "Tag exists."

  test-github-output:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          # if the following value is missing (i.e. not triggered via comment workflow)
          # then the default checkout will apply
          ref: ${{ inputs.prRef }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        if: ${{ needs.build.outputs.image_push_option == 'filter' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}


      # Published action contains compiled JS, but we need to compile it here
      - uses: actions/setup-node@v3
        with:
          node-version: 20
      - name: Compile GH action
        run: |
          (cd common && npm install && npm run build)
          (cd github-action/ && npm install && npm run build && npm run package)


      - id: github-output
        name: Build and run test with GITHUB_OUTPUT
        uses: ./
        with:
          subFolder: github-tests/Dockerfile/outputs
          imageName: ghcr.io/devcontainers/ci/tests/outputs
          imageTag: ${{ needs.build.outputs.image_tag }}
          push: ${{ needs.build.outputs.image_push_option }}
          eventFilterForPush: |
            push
            pull_request
          runCmd: |
            echo "test=hello" >> "$GITHUB_OUTPUT"
            echo "test2=world" >> "$GITHUB_OUTPUT"
            echo "TEST_ENV=env_value" >> "$GITHUB_ENV"
            echo "/mnt/test/path" >> "$GITHUB_PATH"

      - name: Validate output
        run: |
          set -e
          echo "Test outputs..."
          test "${{ steps.github-output.outputs.test }}" == "hello"
          test "${{ steps.github-output.outputs.test2 }}" == "world"
          
          echo "Test Env"
          test "${TEST_ENV}" == "env_value"

          echo "Test Path"
          echo "${PATH}" | grep -q "/mnt/test/path"