Skip to content

test backend

test backend #3

Workflow file for this run

name: probe-plain-alpine
on:
workflow_dispatch:
push:
branches: ["test/gitlab-ci-with-opencode-images"]
jobs:
probe:
runs-on: ubuntu-latest
env:
REGISTRY: registry.opencode.de
GITLAB: https://gitlab.opencode.de
IMG: bundesdruckerei-gmbh/plain-images/alpine
TAG: "3.23"
steps:
- name: Egress-Standort bestätigen
continue-on-error: true
run: |
out=$(curl -fsS https://ipinfo.io/json) || { echo "ipinfo nicht erreichbar"; exit 0; }
echo "$out" | jq '{country, region, org}' || echo "$out"
- name: DNS-Auflösung der Registry
continue-on-error: true
run: |
getent hosts "$REGISTRY" || echo "Keine Auflösung für $REGISTRY"
- name: Registry erreichbar? (erwartet HTTP 401)
continue-on-error: true
run: |
code=$(curl -s -o /dev/null -w "%{http_code}" "https://$REGISTRY/v2/")
echo "GET /v2/ -> HTTP $code (401 = erreichbar + Auth-Realm aktiv)"
- name: Manifest anonym prüfen (public + Tag vorhanden?)
continue-on-error: true
run: |
TOKEN=$(curl -fsS "$GITLAB/jwt/auth?service=container_registry&scope=repository:${IMG}:pull" | jq -r .token)
code=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer $TOKEN" \
-H "Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json" \
"https://$REGISTRY/v2/${IMG}/manifests/${TAG}")
echo "Manifest ${IMG}:${TAG} -> HTTP $code (200 = anonym ziehbar)"
- name: Blob-Backend
continue-on-error: true
run: |
TOKEN=$(curl -fsS "$GITLAB/jwt/auth?service=container_registry&scope=repository:${IMG}:pull" | jq -r .token)
AUTH="Authorization: Bearer $TOKEN"
ACC="Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json"
MAN=$(curl -fsS -H "$AUTH" -H "$ACC" "https://$REGISTRY/v2/$IMG/manifests/$TAG")
SUB=$(echo "$MAN" | jq -r '.manifests[]? | select(.platform.architecture=="amd64" and .platform.os=="linux") | .digest' | head -n1)
[ -n "$SUB" ] && [ "$SUB" != "null" ] && MAN=$(curl -fsS -H "$AUTH" -H "$ACC" "https://$REGISTRY/v2/$IMG/manifests/$SUB")
DIGEST=$(echo "$MAN" | jq -r '.config.digest // .layers[0].digest')
echo "Blob: $DIGEST"
# 307-Redirect zeigt den Storage-Host im Location-Header:
LOC=$(curl -s -o /dev/null -D - -H "$AUTH" "https://$REGISTRY/v2/$IMG/blobs/$DIGEST" | awk -F': ' 'tolower($1)=="location"{print $2}' | tr -d '\r')
echo "Backend-URL: $LOC"
HOST=$(echo "$LOC" | sed -E 's#https?://([^/]+)/.*#\1#')
echo "Backend-Host: $HOST"
# Erreichbarkeit/TLS getrennt nach v4/v6 (Runner-IPv6 ist oft kaputt):
curl -4 -sS -o /dev/null -w "IPv4 -> HTTP %{http_code}, TLS %{time_appconnect}s\n" --max-time 15 "https://$HOST/" || echo "IPv4 fehlgeschlagen"
curl -6 -sS -o /dev/null -w "IPv6 -> HTTP %{http_code}, TLS %{time_appconnect}s\n" --max-time 15 "https://$HOST/" || echo "IPv6 fehlgeschlagen"
- name: Pull-Test (der eigentliche Beweis)
run: |
docker pull "$REGISTRY/$IMG:$TAG"
docker image inspect "$REGISTRY/$IMG:$TAG" \
--format 'OK: {{.Id}} ({{.Os}}/{{.Architecture}})'