Improving Microcks delivery and validation with GitHub Actions CI deployment tests

[yada]

Note

This issue reflects our community's decision to submit projects to the LFX mentorship program.
See: https://github.com/orgs/microcks/discussions/1463
Project Idea 6 : Improving Microcks delivery and validation with GitHub Actions CI deployment tests

This project focuses on enhancing the reliability and quality of Microcks releases by introducing comprehensive CI deployment tests and validations using GitHub Actions. While the project already includes unit and integration tests, recent issues (ex: #1470 and https://bugs.openjdk.org/browse/JDK-8345296) with dependencies have underscored the need for end-to-end validation to ensure new integrations do not introduce bugs or regressions.

Participants will develop workflows for building and deploying Microcks and running automated tests to confirm its functionality under real-world scenarios. This will help prevent edge cases and dependency-related issues affecting the Microcks community and adopters.

Workflows encompass a bunch of deployment tests:

• Testing of container images (with docker, with podman, on different architectures, ...)
• Testing of common docker-compose configurations
• Testing of Helm chart with different setup options
• ...

This project improves the delivery process to ensure that Microcks releases meet the community's expectations for quality and reliability.

[inosmeet]

Hi @yada!,

I'm interested in this project! I have experience working with GitHub Actions and CI/CD test workflows. I'd love to contribute to improving Microcks' delivery process through comprehensive deployment tests.

Are there any pre-tests or prerequisites I should be aware of before applying?

Looking forward to discussing this further!

[lbroudoux]

Hey @inosmeet, that's awesome!

I think the first step would be to have a look at the main build-verify.yml GitHub actions workflow in the repository and share your thoughts about it. We have a lot of ideas about things we'd like to improve/do differently or add to it, but it's always nice to have a fresh and unbiased view first.

[yada]

Hi @inosmeet ,

Thank you for your interest in this project; your help and contribution are greatly appreciated.

Please join as a mentee on the LFX mentorship program; this project is now online. For further details, see my latest comment in this thread: https://github.com/orgs/microcks/discussions/1463#discussioncomment-12067922

The direct link to this project is: https://mentorship.lfx.linuxfoundation.org/project/0c667baa-94bf-405c-ada6-c2bea3bf3e56
and click on "Become a Mentee" in the top right corner.

Then, at the beginning of March, we will select mentee(s) and move forward on the project itself with mentors.
Thank you
Regards,
Yacine

[vickybesra]

Hey @yada , I hope you're well. I'm very interested in the Microcks project on improving delivery and validation with GitHub Actions CI tests. I have hands-on experience with CI/CD and container testing, and I believe I can help build workflows that test our container images, docker-compose setups, and Helm charts to catch issues before releases. I’d love to work on this project for the upcoming LFX Term 1 and help ensure our releases are reliable and bug-free. Thank you for your consideration.

[inosmeet]

Hi @lbroudoux!

Thank you for your prompt reply! I do apologize for late reply (I had last couple of exams at college).

After analyzing build-verify.yaml, here are my observations and ideas for enhancing deployment testing and reliability. Do let me know if I got anything wrong here :)

Current Strengths

1. Solid Foundation: The workflow effectively handles multi-arch builds, secure signing (Cosign + OIDC), and branch/tag-based conditional logic.
2. Integration Testing: Integration tests for the webapp and async minion are a great start for catching issues early.

Areas for Improvement

Based on the project’s goals (e.g., testing Docker/Podman, Helm, multi-arch), here’s what I’d propose:

1. End-to-End Deployment

   • Docker Compose: Add a step to deploy the built images and run smoke tests (e.g., API health checks).
   • Helm Charts: Use tools like chart-testing to test Helm deployments.

2. Multi-Architecture

   • Validate images on both amd64 and arm64 runners (e.g., using GitHub’s matrix jobs or self-hosted ARM runners).

3. Podman Compatibility

   • Add a job to verify images work with Podman (e.g., podman run smoke tests).

4. Security & Dependency

   • Integrate Trivy for vulnerability scanning of container.
   • I was selected as a GSoC'24 student for cve-bin-tool, which is also a great tool for vulnerability scanning. We can also incorporate this.

5. Workflow Efficiency

   • Parallelize jobs (e.g., separate Docker/Podman/Helm tests) to reduce execution time.

6. Pre-release Staging

   • Push images to a staging registry first, run validation, and promote to production registries afterward.

Questions for Clarification
1. Are there existing test environments (e.g., Kubernetes clusters) for Helm/Compose validations?
2. Are ARM64 runners available, or should we emulate architectures (e.g., QEMU)?

I’d love to prototype one of these improvements (e.g., Docker Compose deployment tests) to demonstrate value early (if possible ofcource). Let me know which area aligns best with the project’s priorities!

[yada]

Hi all,

You are welcome; thank you for your interest in this project. Please check the comments above and this thread:
https://github.com/orgs/microcks/discussions/1463#discussioncomment-12067922

We must follow the LFX mentorship program process and timeframe.

Thank you
Regards,
Yacine

[inosmeet]

Hey @yada! @lbroudoux!

Before I apply, I want to ensure I can write an accurate and well-aligned cover letter/proposal. Would it be possible to discuss the issue further here or via email? This would help me clarify the scope, requirements, and any specific expectations for the mentorship project.

Looking forward to your guidance!

Best regards,
Meet

[yada]

Hey @yada! @lbroudoux!

Before I apply, I want to ensure I can write an accurate and well-aligned cover letter/proposal. Would it be possible to discuss the issue further here or via email? This would help me clarify the scope, requirements, and any specific expectations for the mentorship project.

Looking forward to your guidance!

Best regards, Meet

Thanks, @inosmeet. We understand your feedback/guidance request and will do our best to reply to your comment above. Please also join us on Discord to open the conversation.

[yada]

Hi, all LFX mentorship enthusiasts,

First of all, thanks, as we are glad to see so many mentees request and interest in Microcks 🙌

To reply to "all" recurrent questions we have:
No pretests. Selections will be made based on mentees' profiles, motivations and experience. See:
https://github.com/cncf/mentoring/blob/main/programs/lfx-mentorship/README.md#mentee-selection-process
https://docs.linuxfoundation.org/lfx/mentorship/mentor-guide/mentorship-faqs

Of course, you can always start to join the community and contribute to it (outside of the 7 LFX mentorship projects, as we do not want to bypass the program process and want it to be fair for all). But, yes, starting to contribute is clearly the best way for mentees to check and immerse themself within the community, see what is expected and demonstrate their motivation 😉

Please join us on Discord. We have a dedicated channel for LFX mentorship to centralize messages. See:
https://github.com/orgs/microcks/discussions/1463#discussioncomment-12081057

Best regards,
Laurent & Yacine (Microcks maintainers)

[inosmeet]

Hi @lbroudoux!
I wanted to follow up on my response to #5(comment) regarding my understanding of the project, as it would help me come up with a proposal/cover letter. I’m eager to contribute and would appreciate any feedback.

Best regards,
Meet