DRAFT: add test and scan for docker images

.github/workflows/test.yml

@@ -28,3 +28,65 @@ jobs:
       run: |
         pytest -n auto -m "not serial"
         pytest -m "serial"
+
+  test-docker:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/386
+          - linux/amd64
+          - linux/arm/v6
+          - linux/arm/v7
+          - linux/arm64
+          - linux/ppc64le
+          - linux/s390x
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v1
+
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v1
+
+    - name: Available platforms
+      run: echo ${{ steps.buildx.outputs.platforms }}
+
+    - name: Build and push to Local registry
+      id: build-image
+      run: |
+        docker buildx build \
+          --file Dockerfile . \
+          --tag $REPO:${COMMIT_SHA} \
+          --build-arg VERSION=${COMMIT_SHA} \
+          --platform ${{ matrix.platform }} \
+          --load
+        echo "::set-output name=image_name::$REPO:${COMMIT_SHA}"
+      env:
+        COMMIT_SHA: ${{ github.sha }}
+        REPO: datasetteproject/datasette
+
+    - name: Test Docker image
+      run: |
+        docker run -v `pwd`:/mnt --platform ${{ matrix.platform }} \
+            ${{ steps.build-image.outputs.image_name }} bash -c '
+              apt-get update --yes && apt-get install --yes gcc && \
+              pip install "pytest>=5.2.2,<6.3.0" \
+              "pytest-xdist>=2.2.1,<2.3" \
+              "pytest-asyncio>=0.10,<0.16" \
+              "beautifulsoup4>=4.8.1,<4.10.0" \
+              "black==21.5b1" \
+              "pytest-timeout>=1.4.2,<1.5" \
+              "trustme>=0.7,<0.8" \
+              && cd /mnt && pytest'
+
+    # Scan image for vulnerabilities
+    - uses: Azure/container-scan@v0
+      with:
+        image-name: ${{ steps.build-image.outputs.image_name }}
+        severity-threshold: CRITICAL
+        run-quality-checks: false

Dockerfile

@@ -8,7 +8,7 @@ ARG VERSION
 # which we need in order to install a more recent release
 # of libsqlite3-mod-spatialite from the sid distribution
 RUN apt-get update && \
-    apt-get -y --no-install-recommends install software-properties-common && \
+    apt-get -y --no-install-recommends install git software-properties-common && \
     add-apt-repository "deb http://httpredir.debian.org/debian sid main" && \
     apt-get update && \
     apt-get -t sid install -y --no-install-recommends libsqlite3-mod-spatialite && \
@@ -17,7 +17,7 @@ RUN apt-get update && \
     rm -rf /var/lib/apt && \
     rm -rf /var/lib/dpkg/info/*
 
-RUN pip install https://github.com/simonw/datasette/archive/refs/tags/${VERSION}.zip && \
+RUN pip install git+git://github.com/simonw/datasette.git@${VERSION} && \
     find /usr/local/lib -name '__pycache__' | xargs rm -r && \
     rm -rf /root/.cache/pip