From 6e61352dfb78d2804e325041064ebcfe10e8674b Mon Sep 17 00:00:00 2001 From: Gwendal Leclerc Date: Sun, 19 Jul 2026 19:26:46 +0200 Subject: [PATCH] ci(docker): smoke-test the image before publishing it The deploy job now builds the native amd64 image locally (--load) from the downloaded artifact and runs the smoke test before pushing anything, so a broken image can never reach the registry. The build job's smoke test can't catch artifact-level issues (e.g. the executable bit lost through the artifact round-trip) because it builds the binary locally, not from the artifact. Co-Authored-By: Claude Opus 4.8 --- Makefile | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Makefile b/Makefile index 49ffa41..7ef989a 100644 --- a/Makefile +++ b/Makefile @@ -237,6 +237,14 @@ deploy-docker: # Assemble and push the multi-arch image from the pre-built binaries. No compilation and no # QEMU: every target stage is COPY-only (the cert stage runs on the build platform). docker buildx create --use + # Smoke-test BEFORE publishing anything: build the native amd64 image locally (--load) from the + # exact downloaded artifact — which has lost its executable bit through the GitHub artifact + # round-trip — then run it and check it serves. Nothing is pushed unless this passes, so a + # broken image can never reach the registry (the build job's smoke can't catch this: it builds + # the binary locally, never from the artifact). + docker buildx build --load --platform linux/amd64 --tag $(DOCKER_IMAGE):$(DOCKER_TAG) . + $(MAKE) start-docker smoke-docker + docker rm -f $(APPNAME) >/dev/null 2>&1 || true ifdef IS_SEMVER docker buildx build --push --platform $(DOCKER_PLATFORMS) --tag $(DOCKER_IMAGE):latest . endif