mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-25 00:02:25 +02:00
Tim FandLéo
a0c93f38ef
* chore: harden and update supporting services * chore(compose): pin ChromaDB and ntfy images by tag and digest chromadb/chroma:latest and a bare binwiederhier/ntfy change underneath an existing install on the next pull, so two hosts on the same commit can run different sidecar builds. SearXNG is already pinned this way. Pin chroma 1.5.9 and ntfy v2.32.0 to the multi-arch index digests that :latest currently resolves to, so nothing changes at runtime today. The standalone GPU files carry the same references, as test_gpu_compose_standalone.py requires. Add a test that every sidecar image has a release tag and a digest. --------- Co-authored-by: Léo <leograndcontact@gmail.com>
35 lines
1.3 KiB
Python
35 lines
1.3 KiB
Python
"""Sidecar images must be pinned to a versioned tag and an immutable digest.
|
|
|
|
A bare or ``:latest`` reference changes underneath an existing install on the
|
|
next ``docker compose pull``/``up``, so two hosts on the same commit can run
|
|
different ChromaDB or ntfy builds. The ``odysseus`` service is excluded: it is
|
|
the project's own image, selected through ``ODYSSEUS_IMAGE``. The standalone
|
|
GPU files are held equal to these services by test_gpu_compose_standalone.py.
|
|
"""
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
COMPOSE = Path(__file__).resolve().parents[1] / "docker-compose.yml"
|
|
PINNED = re.compile(r"^[\w.\-/]+:(?P<tag>[\w.\-]+)@sha256:[0-9a-f]{64}$")
|
|
|
|
|
|
def _sidecars():
|
|
services = yaml.safe_load(COMPOSE.read_text(encoding="utf-8"))["services"]
|
|
return {name: svc["image"] for name, svc in services.items() if name != "odysseus"}
|
|
|
|
|
|
def test_expected_sidecars_present():
|
|
assert {"chromadb", "searxng", "ntfy"} <= set(_sidecars())
|
|
|
|
|
|
@pytest.mark.parametrize("name", sorted(_sidecars()))
|
|
def test_sidecar_image_has_version_tag_and_digest(name):
|
|
image = _sidecars()[name]
|
|
match = PINNED.match(image)
|
|
assert match, f"{name}: expected <repo>:<tag>@sha256:<digest>, got {image!r}"
|
|
assert match.group("tag") != "latest", f"{name}: pin a release tag, not latest"
|