test backend #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: probe-plain-alpine | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: ["test/gitlab-ci-with-opencode-images"] | |
| jobs: | |
| probe: | |
| runs-on: ubuntu-latest | |
| env: | |
| REGISTRY: registry.opencode.de | |
| GITLAB: https://gitlab.opencode.de | |
| IMG: bundesdruckerei-gmbh/plain-images/alpine | |
| TAG: "3.23" | |
| steps: | |
| - name: Egress-Standort bestätigen | |
| continue-on-error: true | |
| run: | | |
| out=$(curl -fsS https://ipinfo.io/json) || { echo "ipinfo nicht erreichbar"; exit 0; } | |
| echo "$out" | jq '{country, region, org}' || echo "$out" | |
| - name: DNS-Auflösung der Registry | |
| continue-on-error: true | |
| run: | | |
| getent hosts "$REGISTRY" || echo "Keine Auflösung für $REGISTRY" | |
| - name: Registry erreichbar? (erwartet HTTP 401) | |
| continue-on-error: true | |
| run: | | |
| code=$(curl -s -o /dev/null -w "%{http_code}" "https://$REGISTRY/v2/") | |
| echo "GET /v2/ -> HTTP $code (401 = erreichbar + Auth-Realm aktiv)" | |
| - name: Manifest anonym prüfen (public + Tag vorhanden?) | |
| continue-on-error: true | |
| run: | | |
| TOKEN=$(curl -fsS "$GITLAB/jwt/auth?service=container_registry&scope=repository:${IMG}:pull" | jq -r .token) | |
| code=$(curl -s -o /dev/null -w "%{http_code}" \ | |
| -H "Authorization: Bearer $TOKEN" \ | |
| -H "Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json" \ | |
| "https://$REGISTRY/v2/${IMG}/manifests/${TAG}") | |
| echo "Manifest ${IMG}:${TAG} -> HTTP $code (200 = anonym ziehbar)" | |
| - name: Blob-Backend | |
| continue-on-error: true | |
| run: | | |
| TOKEN=$(curl -fsS "$GITLAB/jwt/auth?service=container_registry&scope=repository:${IMG}:pull" | jq -r .token) | |
| AUTH="Authorization: Bearer $TOKEN" | |
| ACC="Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json" | |
| MAN=$(curl -fsS -H "$AUTH" -H "$ACC" "https://$REGISTRY/v2/$IMG/manifests/$TAG") | |
| SUB=$(echo "$MAN" | jq -r '.manifests[]? | select(.platform.architecture=="amd64" and .platform.os=="linux") | .digest' | head -n1) | |
| [ -n "$SUB" ] && [ "$SUB" != "null" ] && MAN=$(curl -fsS -H "$AUTH" -H "$ACC" "https://$REGISTRY/v2/$IMG/manifests/$SUB") | |
| DIGEST=$(echo "$MAN" | jq -r '.config.digest // .layers[0].digest') | |
| echo "Blob: $DIGEST" | |
| # 307-Redirect zeigt den Storage-Host im Location-Header: | |
| LOC=$(curl -s -o /dev/null -D - -H "$AUTH" "https://$REGISTRY/v2/$IMG/blobs/$DIGEST" | awk -F': ' 'tolower($1)=="location"{print $2}' | tr -d '\r') | |
| echo "Backend-URL: $LOC" | |
| HOST=$(echo "$LOC" | sed -E 's#https?://([^/]+)/.*#\1#') | |
| echo "Backend-Host: $HOST" | |
| # Erreichbarkeit/TLS getrennt nach v4/v6 (Runner-IPv6 ist oft kaputt): | |
| curl -4 -sS -o /dev/null -w "IPv4 -> HTTP %{http_code}, TLS %{time_appconnect}s\n" --max-time 15 "https://$HOST/" || echo "IPv4 fehlgeschlagen" | |
| curl -6 -sS -o /dev/null -w "IPv6 -> HTTP %{http_code}, TLS %{time_appconnect}s\n" --max-time 15 "https://$HOST/" || echo "IPv6 fehlgeschlagen" | |
| - name: Pull-Test (der eigentliche Beweis) | |
| run: | | |
| docker pull "$REGISTRY/$IMG:$TAG" | |
| docker image inspect "$REGISTRY/$IMG:$TAG" \ | |
| --format 'OK: {{.Id}} ({{.Os}}/{{.Architecture}})' |