tests: add changesets from focal to xenial as well (#819)

.circleci/config.yml

@@ -131,6 +131,8 @@ jobs:
     machine:
       image: ubuntu-2004:202111-02
       docker_layer_caching: true
+    environment:
+      DOCKER_BUILDKIT: 1
     resource_class: xlarge
     steps:
       - checkout
@@ -179,6 +181,31 @@ jobs:
             - save-images:
                 images: "${SHA1_IMAGE_URL} ${GIT_TAG_IMAGE_URL} ${BRANCH_IMAGE_URL} ${SHA1_IMAGE_URL}-test ${BRANCH_IMAGE_URL}-test"
 
+  container-structure-tests:
+    parameters:
+      container-image:
+        type: string
+    machine:
+      image: ubuntu-2004:202111-02
+    resource_class: xlarge
+    steps:
+      - checkout
+      - setup-remote-docker-with-experimental-feats
+      # Load the previously saved docker images from the CCI workspace
+      - load-images
+      # Compute the env vars with the resulting docker tags and docker image names
+      - compute-docker-tags:
+          image-name: << parameters.container-image >>
+      - run:
+          name: Install Google Container Structure Test
+          command: curl -LO https://storage.googleapis.com/container-structure-test/latest/container-structure-test-linux-amd64 && chmod +x container-structure-test-linux-amd64 && mkdir -p $HOME/bin && export PATH=$PATH:$HOME/bin && mv container-structure-test-linux-amd64 $HOME/bin/container-structure-test
+      - run:
+          name: Run Tests
+          command: |
+            container-structure-test test --image ${SHA1_IMAGE_URL} --config xenial.yaml --test-report container-structure.xml --output junit
+      - store_test_results:
+          path: ./container-structure.xml
+
   run-tests:
     parameters:
       container-image:
@@ -226,13 +253,6 @@ jobs:
           image: << parameters.container-image >>
           tag: "${IMAGE_TAG_LIST}"
 
-  # Lint our Dockerfile
-  lint:
-    executor: docker/machine
-    steps:
-      - checkout
-      - docker/dockerlint
-
 # Workflows are where we specify the job order and job parameters (if applicable)
 workflows:
   # Workflow responsible for building git tags (commonly the final releases we use within buildbot)
@@ -267,7 +287,8 @@ workflows:
   # Workflow responsible for building, pushing and testing branches and PR forks
   build-test-and-push:
     jobs:
-      - lint
+      - docker/hadolint:
+          ignore-rules: "DL3003,DL3008,DL4001,DL4006"
       # Only push images directly if building from a trusted source
       # (i.e. not a forked repo)
       - build-and-push-images:
@@ -300,4 +321,9 @@ workflows:
           requires: [hold-push-to-registry]
       - run-tests:
           container-image: "netlify/build"
-          requires: [build-and-push-images, build-images-for-forks, lint]
+          requires:
+            [build-and-push-images, build-images-for-forks, docker/hadolint]
+      - container-structure-tests:
+          container-image: "netlify/build"
+          requires:
+            [build-and-push-images, build-images-for-forks, docker/hadolint]

.github/workflows/whalescale.yml

@@ -13,6 +13,8 @@ jobs:
         continue-on-error: true
       # Build the current commit in order to run the size checks
       - name: Build Docker image
+        env:
+          DOCKER_BUILDKIT: 1
         run: docker build . --build-arg NF_IMAGE_VERSION=$GITHUB_SHA  --target build-image -t netlify/build:$GITHUB_SHA
       # Compare the new size of the docker image
       - name: Check new image size

CONTRIBUTING.md

@@ -3,12 +3,6 @@
 Contributions are always welcome, no matter how large or small. Before contributing,
 please read the [code of conduct](CODE_OF_CONDUCT.md).
 
-## Releasing
-
-1. Merge the relevant package release PR created by `release-please`
-2. Wait for the Jenkins build to finish
-3. Create a PR in the [buildbot](https://github.com/netlify/buildbot) to bump [the version](https://github.com/netlify/buildbot/blob/a247edab7ead955cc27bb70ecc9f081e68f1aea6/script/docker-build.sh#L17) of the `build-image`.
-
 ## Development
 
 ### Linting
@@ -17,7 +11,31 @@ please read the [code of conduct](CODE_OF_CONDUCT.md).
 
 ### Tests
 
-We have a set of automated tests in [./tests](./tests). These are [bats](https://github.com/bats-core/bats-core) tests that we use to make assertions not only on the correct functioning of our bash/shell scripts, but also of the software provided by our Docker image. Any fix or feature should be accompanied by a set of tests to validate that those changes work as expected. For an overview on how [bats works see here](https://bats-core.readthedocs.io/en/stable/).
+For testing the Docker Image we use Googles [Container Structure Tests](https://github.com/GoogleContainerTools/container-structure-test). Those tests are used to test the metadata, filesystem or installed binaries of the image.
+
+#### Installing Container Structure Tests
+
+To install the container tests we recommend doing so by using a package manger like brew:
+
+```
+brew install container-structure-tests
+```
+
+#### Running Container Structure Tests
+
+To run the container structure tests you need to run the following command.
+
+```bash
+container-structure-test test  --image netlify/build:focal --config focal.yaml
+```
+
+For further install instructions please visit the [official installation guide](https://github.com/GoogleContainerTools/container-structure-test#installation).
+
+### Testing dynamic Versions
+
+To test Golang or Node versions which are dynamically downloaded via a script on startup we have a set of automated tests in [./tests](./tests). These are [bats](https://github.com/bats-core/bats-core) tests that we use to make assertions not only on the correct functioning of our bash/shell scripts, but also of the software provided by our Docker image. For an overview on how [bats works see here](https://bats-core.readthedocs.io/en/stable/).
+
+<mark>In General any fix or feature should be accompanied by a set of tests to validate that those changes work as expected.</mark>
 
 ### Developing
 
@@ -39,11 +57,11 @@ For the CI validation to succeed, make sure that **your PRs and commits follow t
 The bulk of our CI work takes place in [Circle CI](https://app.circleci.com/pipelines/github/netlify/build-image).
 
 If **you're part of the Netlify org** and have write access to the repo, our pipeline will take care of:
+
 - Linting the Dockerfile
 - Build your Dockerfile, tag it, and push it to our [docker hub repo](https://hub.docker.com/r/netlify/build)
 - Run the automated [bats tests](#tests)
 
-
 If you **don't have write access to the repo** and are submitting a PR via a forked repo, the CI pipeline will still execute for you. The main difference is that it won't push your built image to our docker repo.
 If required, someone with write accesss to the repo can trigger the push for you. If you require it (mainly useful for testing purposes) reach out to someone on the team :+1:
 
@@ -54,6 +72,7 @@ If required, someone with write accesss to the repo can trigger the push for you
 3. Commits which are prefaced withb `fix:` or `feat:` will trigger package release PRs created by [release-please](https://github.com/googleapis/release-please). Merge these PRs. If you need to manually trigger a release-please PR you can bump the version by creating an [empty PR](https://github.com/netlify/build-image/pull/728).
 4. Wait for the CI pipelines to finish. Renovate should automatically create a PR in `buildbot` with the latest `build-image` releases (this may not happen straight away, but you can speed it up by checking [the box in this PR](https://github.com/netlify/buildbot/issues/912) or manually create a PR to bump [the version](https://github.com/netlify/buildbot/blob/0ada244ab84a1759a70d6b2cfc27c9987b5c77ca/.circleci/config.yml#L141-L150)).
 5. Review, test and deploy the PR in `buildbot`.
+
 ### Running Test `buildbot` Releases
 
 If you want to test a particular `build-image` change before going through the regular release process, you can do so by creating a PR following the process above :point-up: and pointing to any `build-image` you want. Any branch

Dockerfile

@@ -183,7 +183,7 @@ RUN wget -nv https://github.com/wkhtmltopdf/wkhtmltopdf/releases/download/0.12.5
     wkhtmltopdf -V
 
 # install Pandoc (more recent version to what is provided in Ubuntu 14.04)
-RUN wget https://github.com/jgm/pandoc/releases/download/$PANDOC_VERSION/pandoc-$PANDOC_VERSION-1-amd64.deb && \
+RUN wget -nv https://github.com/jgm/pandoc/releases/download/$PANDOC_VERSION/pandoc-$PANDOC_VERSION-1-amd64.deb && \
     dpkg -i pandoc-$PANDOC_VERSION-1-amd64.deb && \
     rm pandoc-$PANDOC_VERSION-1-amd64.deb && \
     pandoc -v
@@ -307,8 +307,8 @@ RUN virtualenv -p /opt/buildhome/bin/python3.7 --no-site-packages /opt/buildhome
     /bin/bash -c 'source /opt/buildhome/python3.7/bin/activate' && \
     ln -nfs /opt/buildhome/python3.7 /opt/buildhome/python3.7.2
 
-RUN /opt/buildhome/python${PIPENV_RUNTIME}/bin/pip install "setuptools<45"
-RUN /opt/buildhome/python${PIPENV_RUNTIME}/bin/pip install pipenv
+RUN /opt/buildhome/python${PIPENV_RUNTIME}/bin/pip install "setuptools<45" && \
+    /opt/buildhome/python${PIPENV_RUNTIME}/bin/pip install pipenv
 
 USER root
 
@@ -363,9 +363,8 @@ RUN curl -sL https://download.clojure.org/install/linux-install-1.10.1.492.sh |
 
 USER buildbot
 
-RUN lein
-
-RUN boot -u
+RUN lein && \
+    boot -u
 
 ################################################################################
 #
@@ -380,8 +379,8 @@ COPY lib/php/5.6 /php/5.6
 COPY lib/php/7.2 /php/7.2
 COPY lib/php/7.4 /php/7.4
 
-RUN dpkg -i /php/dependencies/libssl1.1_1.1.1k-1+ubuntu16.04.1+deb.sury.org+0_amd64.deb
-RUN dpkg -i /php/dependencies/psmisc_22.21-2.1ubuntu0.1_amd64.deb
+RUN dpkg -i /php/dependencies/libssl1.1_1.1.1k-1+ubuntu16.04.1+deb.sury.org+0_amd64.deb && \
+    dpkg -i /php/dependencies/psmisc_22.21-2.1ubuntu0.1_amd64.deb
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg -i /php/dependencies/*.deb && \
@@ -448,9 +447,9 @@ RUN gimme | bash
 ################################################################################
 WORKDIR /tmp
 ENV DOTNET_VERSION 6.0
-RUN wget https://dot.net/v1/dotnet-install.sh
-RUN chmod u+x /tmp/dotnet-install.sh
-RUN /tmp/dotnet-install.sh -c ${DOTNET_VERSION}
+RUN wget -nv https://dot.net/v1/dotnet-install.sh && \
+    chmod u+x /tmp/dotnet-install.sh && \
+    /tmp/dotnet-install.sh -c ${DOTNET_VERSION}
 ENV PATH "$PATH:/opt/buildhome/.dotnet/tools"
 ENV PATH "$PATH:/opt/buildhome/.dotnet"
 ENV DOTNET_ROOT "/opt/buildhome/.dotnet"
@@ -498,11 +497,12 @@ USER root
 
 # Add buildscript for local testing
 RUN mkdir -p /opt/build-bin
-ADD run-build-functions.sh /opt/build-bin/run-build-functions.sh
-ADD run-build.sh /opt/build-bin/build
-ADD buildbot-git-config /root/.gitconfig
-RUN rm -r /tmp/*
-RUN rm -r /php
+COPY run-build-functions.sh /opt/build-bin/run-build-functions.sh
+COPY run-build.sh /opt/build-bin/build
+COPY buildbot-git-config /root/.gitconfig
+
+RUN rm -r /tmp/* && \
+    rm -r /php
 
 USER buildbot
 # The semver version associated with this build (i.e. v3.0.0)
@@ -529,15 +529,15 @@ FROM build-image as build-image-test
 USER buildbot
 SHELL ["/bin/bash", "-c"]
 
-ADD --chown=buildbot:buildbot package.json /opt/buildhome/test-env/package.json
+COPY --chown=buildbot:buildbot package.json /opt/buildhome/test-env/package.json
 
 # We need to install with `--legacy-peer-deps` because of:
 # https://github.com/bats-core/bats-assert/issues/27
 RUN cd /opt/buildhome/test-env && . ~/.nvm/nvm.sh && npm i --legacy-peer-deps &&\
     ln -s /opt/build-bin/run-build-functions.sh /opt/buildhome/test-env/run-build-functions.sh &&\
     ln -s /opt/build-bin/build /opt/buildhome/test-env/run-build.sh
 
-ADD --chown=buildbot:buildbot tests /opt/buildhome/test-env/tests
+COPY --chown=buildbot:buildbot tests /opt/buildhome/test-env/tests
 WORKDIR /opt/buildhome/test-env
 
 # Set `bats` as entrypoint