fix(ci): isolate deployment smoke client (#1)

2026-07-17 01:53:50 +02:00
parent 769336e424
commit a77d4b801c
4 changed files with 61 additions and 36 deletions
@@ -144,18 +144,19 @@ jobs:
          set -euo pipefail
          compose_file="deploy/compose/compose.yaml"
          secret="deploy/compose/secrets/signing-key"
-          compose_network=""
          cleanup() {
-            if [[ -n "$compose_network" ]]; then
-              docker network disconnect "$compose_network" "$HOSTNAME" >/dev/null 2>&1 || true
-            fi
            RENDEZVOUS_UID=1654 RENDEZVOUS_GID=1654 \
              docker compose -f "$compose_file" down --volumes >/dev/null 2>&1 || true
            rm -f "$secret"
          }
          trap cleanup EXIT
+          umask 077
          install -d -m 0700 deploy/compose/secrets
          openssl rand -out "$secret" 32
+          chmod 0600 "$secret"
+          publisher_credential="$(RENDEZVOUS_SMOKE_LOCAL_KEY="$secret" \
+            ./scripts/mint-local-publisher-credential.sh)"
+          export RENDEZVOUS_PUBLISHER_CREDENTIAL="$publisher_credential"
          chmod 0444 "$secret"
          export RENDEZVOUS_UID=1654
          export RENDEZVOUS_GID=1654
@@ -168,6 +169,10 @@ jobs:
          export RENDEZVOUS_CONFIG_SOURCE="$runner_workspace_source/deploy/compose/appsettings.Production.json"
          export RENDEZVOUS_SECRET_SOURCE="$runner_workspace_source/deploy/compose/secrets/signing-key"
          export SOURCE_REVISION_ID="$GITHUB_SHA"
+          smoke_client_image="rendezvous-smoke-client:${GITHUB_SHA}"
+          docker build --file eng/release-builder.Dockerfile \
+            --target release-builder \
+            --tag "$smoke_client_image" .
          docker compose -f "$compose_file" build \
            --build-arg SOURCE_REVISION_ID="$SOURCE_REVISION_ID"
          docker compose -f "$compose_file" up --no-build --detach
@@ -175,27 +180,33 @@ jobs:
          test -n "$container_id"
          compose_network="$(docker inspect "$container_id" | jq -er \
            '.[0].NetworkSettings.Networks | keys[0]')"
-          docker network connect "$compose_network" "$HOSTNAME"
          service_ip="$(docker inspect "$container_id" | jq -er \
            --arg network "$compose_network" \
            '.[0].NetworkSettings.Networks[$network].IPAddress')"
-          export RENDEZVOUS_SMOKE_HTTP_URL="http://${service_ip}:8080/"
-          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="${service_ip}:9050"
          test "$(docker inspect --format '{{.Config.User}}' "$container_id")" = "1654:1654"
          test "$(docker inspect --format '{{.HostConfig.ReadonlyRootfs}}' "$container_id")" = "true"
          test "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/app/appsettings.Production.json"}}{{.RW}}{{end}}{{end}}' "$container_id")" = "false"
          test "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/run/secrets/rendezvous-signing-key"}}{{.RW}}{{end}}{{end}}' "$container_id")" = "false"
-          for attempt in {1..100}; do
-            if curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1; then
-              break
-            fi
-            if (( attempt == 100 )); then
+          docker run --rm \
+            --network "$compose_network" \
+            --user "$(id -u):$(id -g)" \
+            --env HOME=/tmp \
+            --env RENDEZVOUS_SMOKE_HTTP_URL="http://${service_ip}:8080/" \
+            --env RENDEZVOUS_SMOKE_UDP_ENDPOINT="${service_ip}:9050" \
+            --env RENDEZVOUS_PUBLISHER_CREDENTIAL \
+            --volume "$runner_workspace_source:/source:ro" \
+            --workdir /source \
+            "$smoke_client_image" \
+            bash -lc '
+              for attempt in {1..300}; do
+                curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1 && exec ./scripts/smoke-deployment.sh
+                sleep 0.1
+              done
+              exit 1
+            ' || {
              docker compose -f "$compose_file" logs rendezvous
              exit 1
-            fi
-            sleep 0.1
-          done
-          ./scripts/smoke-deployment.sh
+            }
          docker compose -f "$compose_file" stop --timeout 40 rendezvous
          test "$(docker inspect --format '{{.State.Running}}' "$container_id")" = "false"
          test "$(docker inspect --format '{{.State.ExitCode}}' "$container_id")" = "0"
@@ -112,18 +112,19 @@ jobs:
        run: |
          set -euo pipefail
          secret="deploy/compose/secrets/signing-key"
-          compose_network=""
          cleanup() {
-            if [[ -n "$compose_network" ]]; then
-              docker network disconnect "$compose_network" "$HOSTNAME" >/dev/null 2>&1 || true
-            fi
            RENDEZVOUS_UID=1654 RENDEZVOUS_GID=1654 RENDEZVOUS_IMAGE="git.finalfactory.de/heikyu/rendezvous:${RENDEZVOUS_VERSION}" \
              docker compose -f deploy/compose/compose.yaml down --volumes >/dev/null 2>&1 || true
            rm -f "$secret"
          }
          trap cleanup EXIT
+          umask 077
          install -d -m 0700 deploy/compose/secrets
          openssl rand -out "$secret" 32
+          chmod 0600 "$secret"
+          publisher_credential="$(RENDEZVOUS_SMOKE_LOCAL_KEY="$secret" \
+            ./scripts/mint-local-publisher-credential.sh)"
+          export RENDEZVOUS_PUBLISHER_CREDENTIAL="$publisher_credential"
          chmod 0444 "$secret"
          export RENDEZVOUS_UID=1654
          export RENDEZVOUS_GID=1654
@@ -141,21 +142,29 @@ jobs:
          test -n "$container_id"
          compose_network="$(docker inspect "$container_id" | jq -er \
            '.[0].NetworkSettings.Networks | keys[0]')"
-          docker network connect "$compose_network" "$HOSTNAME"
          service_ip="$(docker inspect "$container_id" | jq -er \
            --arg network "$compose_network" \
            '.[0].NetworkSettings.Networks[$network].IPAddress')"
-          export RENDEZVOUS_SMOKE_HTTP_URL="http://${service_ip}:8080/"
-          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="${service_ip}:9050"
-          for attempt in {1..100}; do
-            curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1 && break
-            if (( attempt == 100 )); then
+          docker run --rm \
+            --network "$compose_network" \
+            --user "$(id -u):$(id -g)" \
+            --env HOME=/tmp \
+            --env RENDEZVOUS_SMOKE_HTTP_URL="http://${service_ip}:8080/" \
+            --env RENDEZVOUS_SMOKE_UDP_ENDPOINT="${service_ip}:9050" \
+            --env RENDEZVOUS_PUBLISHER_CREDENTIAL \
+            --volume "$runner_workspace_source:/source:ro" \
+            --workdir /source \
+            "$RENDEZVOUS_RELEASE_BUILDER" \
+            bash -lc '
+              for attempt in {1..300}; do
+                curl --fail --silent "${RENDEZVOUS_SMOKE_HTTP_URL%/}/health/ready" >/dev/null 2>&1 && exec ./scripts/smoke-deployment.sh
+                sleep 0.1
+              done
+              exit 1
+            ' || {
              docker compose -f deploy/compose/compose.yaml logs rendezvous
              exit 1
-            fi
-            sleep 0.1
-          done
-          ./scripts/smoke-deployment.sh
+            }

      - name: Scan candidate for high and critical vulnerabilities
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0, post-incident safe SHA