docs-fp-o-ci-test/justfile

baseimage_repo := "quay.io/fedora/fedora-minimal"
baseimage_tag := "45"

antora_repo := "quay.io/fedora-docs/antora"
antora_tag := "latest"

site_repo := "quay.io/fedora-docs/council-docs-test"
site_tag := "latest"
site_containerfile := "./build-site-container/Containerfile"

fedocs_cache_repo := "quay.io/fedora-docs/fedocs-cache"
fedocs_cache_tag := "latest"
fedocs_cache_containerfile := "./build-fedocs-containers/Containerfile.cache"

fedocs_repo := "quay.io/fedora-docs/fedocs"
fedocs_tag := "latest"
fedocs_containerfile := "./build-fedocs-containers/Containerfile"

chunkah_repo := "quay.io/coreos/chunkah"
chunkah_tag := "dev"
chunkah_tmp_ociarchive := "chunkah"

nodejs_version := "26"

grype_image := "docker.io/anchore/grype:latest"

org_opencontainers_image_source := "https://forge.fedoraproject.org/docs/docs-fp-o"
org_opencontainers_image_licenses := "MIT"
quay_expires_after := "4w"


all:
    @echo "Please read README.md"

# Verify container image
verify-image image:
    #! /usr/bin/env bash
    set -euo pipefail
    # set -x
    export FORCE_COLUMNS=134

    function main() {
        local -r cosign_image="ghcr.io/sigstore/cosign/cosign:latest"
        # local -r cosign_image="ghcr.io/sigstore/cosign/cosign:latest-dev"
        # local -r cosign_image="ghcr.io/sigstore/cosign/cosign:unstable"
        # local -r cosign_image="ghcr.io/sigstore/cosign/cosign:unstable-dev"
        # local -r cosign_image="ghcr.io/sigstore/cosign/cosign:v3.0.2"
        local -r key="https://forge.stg.fedoraproject.org/playground/docs-fp-o-ci-test/raw/branch/main/docs-fp-o.pub"
        function cosign() {
            podman container run \
                --pull newer \
                --rm \
                --interactive \
                --tty \
                --name cosign \
                    ${cosign_image} \
                    "${@}"
        }
        # Verify Cosign in container image
        # See https://docs.sigstore.dev/cosign/system_config/installation/#verify-cosign-in-container-image
        echo -e "\n Verifying Cosign in ${cosign_image} container image... \n"
        cosign verify ${cosign_image} \
            --certificate-identity keyless@projectsigstore.iam.gserviceaccount.com \
            --certificate-oidc-issuer https://accounts.google.com
        if ! [[ {{image}} =~ ^localhost/.* ]]; then
            echo -e "\nVerifying {{image}}..."
            cosign verify --key ${key} {{image}}
            echo -e "\n"
        fi
    }
    main "${@}"

# Build Docs site container image
build-site playbook="":
    #! /bin/env bash
    set -euo pipefail
    # set -x
    export FORCE_COLUMNS=134

    function main() {

        # Determine latest Antora version
        local -r ANTORA_VERSION=$(curl --silent \
            "https://gitlab.com/api/v4/projects/4180516/repository/tags?order_by=updated&sort=desc&per_page=1" |\
            jq --raw-output '.[].name[1:]')

        # Conditional PLAYBOOK_PATH environment variable
        local playbook_env=""
        if [[ -n "{{playbook}}" ]]; then
            playbook_env="--env PLAYBOOK_PATH={{playbook}}"
        fi

        # Cleanup
        function cleanup() {
            rm --recursive --force {{chunkah_tmp_ociarchive}}
        }

        trap 'cleanup' EXIT

        podman image build \
            --pull=newer \
            --no-cache \
            --security-opt label=type:unconfined_t \
            ${playbook_env} \
            --env NODEJS_VERSION="{{nodejs_version}}" \
            --env ANTORA_VERSION="${ANTORA_VERSION}" \
            --build-arg BASEIMAGE_REPO="{{baseimage_repo}}" \
            --build-arg BASEIMAGE_TAG="{{baseimage_tag}}" \
            --build-arg CHUNKAH_REPO="{{chunkah_repo}}" \
            --build-arg CHUNKAH_TAG="{{chunkah_tag}}" \
            --build-arg CHUNKAH_TMP_OCIARCHIVE="{{chunkah_tmp_ociarchive}}" \
            --build-arg IMAGE_TITLE="Fedora Docs" \
            --build-arg IMAGE_DESCRIPTION="Container image for testing the Fedora Council Docs" \
            --build-arg IMAGE_SOURCE="{{org_opencontainers_image_source}}" \
            --build-arg IMAGE_LICENSES="{{org_opencontainers_image_licenses}}" \
            --build-arg QUAY_EXPIRES_AFTER="{{quay_expires_after}}" \
            --skip-unused-stages=false \
            --tag "{{site_repo}}:{{site_tag}}" \
            --file "{{site_containerfile}}" \
            .

        just list-images
    }
    main "${@}"

# Preview Docs site
preview-site:
    #! /usr/bin/env bash
    set -euo pipefail
    # set -x
    export FORCE_COLUMNS=134

    function main() {
        podman container run \
            --pull=newer \
            --rm \
            --interactive \
            --tty \
            --name fedora-docs \
            --publish 8080:80 \
            {{site_repo}}:{{site_tag}}
    }
    main "${@}"

# Build fedocs-cache container image (prefetched component clones)
build-fedocs-cache playbook="":
    #! /usr/bin/env bash
    set -euo pipefail
    # set -x
    export FORCE_COLUMNS=134

    function main() {

        # Conditional PLAYBOOK_PATH environment variable
        local playbook_path=""
        if [[ -n "{{playbook}}" ]]; then
            playbook_path="{{playbook}}"
        else
            playbook_path="./site.yml"
        fi

        podman image build \
            --pull=newer \
            --no-cache \
            --security-opt label=type:unconfined_t \
            --build-arg BASEIMAGE_REPO="{{antora_repo}}" \
            --build-arg BASEIMAGE_TAG="{{antora_tag}}" \
            --build-arg CHUNKAH_REPO="{{chunkah_repo}}" \
            --build-arg CHUNKAH_TAG="{{chunkah_tag}}" \
            --build-arg PLAYBOOK_PATH="${playbook_path}" \
            --build-arg IMAGE_TITLE="Fedora Docs fedocs cache" \
            --build-arg IMAGE_DESCRIPTION="Prefetched Fedora Docs component clones for fedocs.py local preview and CI" \
            --build-arg IMAGE_SOURCE="{{org_opencontainers_image_source}}" \
            --build-arg IMAGE_LICENSES="{{org_opencontainers_image_licenses}}" \
            --build-arg QUAY_EXPIRES_AFTER="{{quay_expires_after}}" \
            --skip-unused-stages=false \
            --tag "{{fedocs_cache_repo}}:{{fedocs_cache_tag}}" \
            --file "{{fedocs_cache_containerfile}}" \
            .

        just list-images
    }
    main "${@}"

# Build fedocs container image
build-fedocs:
    #! /usr/bin/env bash
    set -euo pipefail
    # set -x
    export FORCE_COLUMNS=134

    function main() {

        podman image build \
            --pull=newer \
            --security-opt label=type:unconfined_t \
            --build-arg BASEIMAGE_REPO="{{antora_repo}}" \
            --build-arg BASEIMAGE_TAG="{{antora_tag}}" \
            --build-arg CHUNKAH_REPO="{{chunkah_repo}}" \
            --build-arg CHUNKAH_TAG="{{chunkah_tag}}" \
            --build-arg IMAGE_TITLE="Fedora Docs fedocs" \
            --build-arg IMAGE_DESCRIPTION="Local watch/build/preview tool for a single Fedora Docs component" \
            --build-arg IMAGE_SOURCE="{{org_opencontainers_image_source}}" \
            --build-arg IMAGE_LICENSES="{{org_opencontainers_image_licenses}}" \
            --build-arg QUAY_EXPIRES_AFTER="{{quay_expires_after}}" \
            --skip-unused-stages=false \
            --tag "{{fedocs_repo}}:{{fedocs_tag}}" \
            --file "{{fedocs_containerfile}}" \
            .

        just list-images
    }
    main "${@}"

# List first 21 images in local storage
list-images:
    #! /usr/bin/env bash
    set -euo pipefail
    # set -x
    export FORCE_COLUMNS=134

    function main() {
        podman images --all | \
            head --lines=21 || \
            [[ ${PIPESTATUS[0]} -eq 141 ]] && \
            true || false
    }
    main "${@}"

# Prune unused images and list first 21 images
cleanup-images:
    #! /usr/bin/env bash
    set -euo pipefail
    # set -x
    export FORCE_COLUMNS=134

    function main() {
        podman image prune --external --force
        podman image prune --build-cache --force
        just list-images
    }
    main "${@}"

# Scan image
scan-image image:
    #! /usr/bin/env bash
    set -euo pipefail
    # set -x
    export FORCE_COLUMNS=134

    function main() {
    podman container run \
        --pull=newer \
        --rm \
        --interactive \
        --tty \
        --name grype \
        {{grype_image}} \
        {{image}}
    }
    main "${@}"