test: add pinning test

Author: thesayyn

.github/workflows/ci.yaml

@@ -63,19 +63,19 @@ jobs:
           - .
           - e2e/wasm
           - e2e/smoke
-          - e2e/pull
+          - e2e/assertion
 
         bzlmodEnabled: [true, false]
         exclude:
           # macos is expensive (billed at 10X) so don't test these
           - os: macos-13
             folder: e2e/wasm
           - os: macos-13
-            folder: e2e/pull
+            folder: e2e/assertion
           - os: macos-13
             bazelversion: 6.4.0
-          # e2e/pull is bzlmod only but it has test for both cases.
-          - folder: e2e/pull
+          # e2e/assertion is bzlmod only but it has test for both cases.
+          - folder: e2e/assertion
             bzlmodEnabled: false
           # TODO: fix
           - folder: e2e/wasm

e2e/platforms/.bazelignore e2e/assertion/.bazelignore

@@ -0,0 +1,65 @@
+load("@aspect_bazel_lib//lib:bats.bzl", "bats_test")
+
+[
+    bats_test(
+        name = "test_oci_pull_auth_%s" % name,
+        size = "large",
+        srcs = [
+            "oci_pull_auth_tests.bats",
+        ],
+        args = [
+            "--verbose-run",
+            "--timing",
+            "--trace",
+        ],
+        data = glob(["credential-helper/**"]) + [
+            "wksp",
+            "//registry:auth",
+        ],
+        env = {
+            "WKSP": "$(location :wksp)",
+            "REGISTRY": "$(rootpath //registry:auth)",
+            "BAZEL_FLAGS": flags,
+        },
+        tags = [
+            "exclusive",
+            "local",
+            "no-remote",
+            "no-remote-exec",
+        ],
+    )
+    for (name, flags) in [
+        ("bzlmod", "--noenable_bzlmod"),
+        ("nobzlmod", "--enable_bzlmod"),
+    ]
+]
+
+[
+    bats_test(
+        name = "test_oci_pull_%s" % name,
+        size = "large",
+        srcs = [
+            "oci_pull_tests.bats",
+        ],
+        args = [
+            "--verbose-run",
+            "--timing",
+            "--trace",
+        ],
+        data = [":wksp"],
+        env = {
+            "WKSP": "$(location :wksp)",
+            "BAZEL_FLAGS": flags,
+        },
+        tags = [
+            "exclusive",
+            "local",
+            "no-remote",
+            "no-remote-exec",
+        ],
+    )
+    for (name, flags) in [
+        ("bzlmod", "--noenable_bzlmod"),
+        ("nobzlmod", "--enable_bzlmod"),
+    ]
+]

e2e/platforms/.bazelrc e2e/assertion/.bazelrc

@@ -46,3 +46,16 @@ setup() {
     run bazel build @distroless_base_single_arch_wrong_amd64_platforms_attr//... --platforms=//platforms:linux_arm64 $BAZEL_FLAGS
     assert_failure
 }
+
+
+@test "when oci_pull with a tag, it should print a warning" {
+    # Even if the target
+    run bazel build @distroless_base_with_tag//... --platforms=//platforms:linux_x86_64 $BAZEL_FLAGS
+    assert_output --partial 'WARNING: Fetching from distroless/cc-debian12@latest without an integrity hash, result will not be cached'
+    assert_output --partial 'For reproducible builds, a digest is recommended.'
+    assert_output --partial "Either set 'reproducible = False' to silence this warning"
+    assert_output --partial "or run the following command to change"
+    assert_output --partial "to use a digest:"
+    assert_output --partial "'remove tag' 'remove platforms'"
+    assert_output --partial 'add platforms "linux/amd64" "linux/arm64/v8" "linux/arm/v7" "linux/s390x" "linux/ppc64le"'
+}

e2e/assertion/BUILD.bazel

@@ -1,21 +1,33 @@
 "Bazel dependencies"
 
-bazel_dep(name = "rules_oci", version = "0.0.0", dev_dependency = True)
-bazel_dep(name = "platforms", version = "0.0.7")
+bazel_dep(name = "rules_oci", version = "0.0.0")
+bazel_dep(name = "platforms", version = "0.0.8")
 
 local_path_override(
     module_name = "rules_oci",
     path = "../../..",
 )
 
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
-
+oci.pull(
+    name = "empty_image",
+    digest = "sha256:e40e202a677ddddeaaf4603df278a6da42130d750622f1b1130bdafe6876a6e0",
+    image = "http://localhost:1447/empty_image",
+)
+use_repo(oci, "empty_image")
+oci.pull(
+    name = "distroless_base_with_tag",
+    image = "gcr.io/distroless/cc-debian12",
+    platforms = [
+        "linux/amd64",
+    ],
+    tag = "latest",
+)
 oci.pull(
     name = "distroless_base_single_arch_no_platforms_attr",
     digest = "sha256:71b79745bb79377e88d936fd362bf505ad9f278f6a613233f0be2f10b96b1b21",
     image = "gcr.io/distroless/base",
 )
-
 oci.pull(
     name = "distroless_base_single_arch_correct_arm64_platforms_attr",
     digest = "sha256:71b79745bb79377e88d936fd362bf505ad9f278f6a613233f0be2f10b96b1b21",
@@ -24,7 +36,6 @@ oci.pull(
         "linux/arm64",
     ],
 )
-
 oci.pull(
     name = "distroless_base_single_arch_wrong_amd64_platforms_attr",
     digest = "sha256:71b79745bb79377e88d936fd362bf505ad9f278f6a613233f0be2f10b96b1b21",
@@ -33,9 +44,13 @@ oci.pull(
         "linux/amd64",
     ],
 )
-
-use_repo(oci,
-    "distroless_base_single_arch_no_platforms_attr",
+use_repo(
+    oci,
     "distroless_base_single_arch_correct_arm64_platforms_attr",
+    "distroless_base_single_arch_correct_arm64_platforms_attr_linux_arm64",
+    "distroless_base_single_arch_no_platforms_attr",
     "distroless_base_single_arch_wrong_amd64_platforms_attr",
+    "distroless_base_single_arch_wrong_amd64_platforms_attr_linux_amd64",
+    "distroless_base_with_tag",
+    "distroless_base_with_tag_linux_amd64",
 )

e2e/pull/MODULE.bazel e2e/assertion/MODULE.bazel

@@ -13,6 +13,12 @@ oci_register_toolchains(name = "oci")
 
 load("@rules_oci//oci:pull.bzl", "oci_pull")
 
+oci_pull(
+    name = "empty_image",
+    digest = "sha256:e40e202a677ddddeaaf4603df278a6da42130d750622f1b1130bdafe6876a6e0",
+    image = "http://localhost:1447/empty_image",
+)
+
 oci_pull(
     name = "distroless_base_single_arch_no_platforms_attr",
     digest = "sha256:71b79745bb79377e88d936fd362bf505ad9f278f6a613233f0be2f10b96b1b21",
@@ -36,3 +42,12 @@ oci_pull(
         "linux/amd64",
     ],
 )
+
+oci_pull(
+    name = "distroless_base_with_tag",
+    image = "gcr.io/distroless/cc-debian12",
+    platforms = [
+        "linux/amd64",
+    ],
+    tag = "latest",
+)

e2e/pull/credential-helper/docker-credential-evil e2e/assertion/credential-helper/docker-credential-evil

@@ -0,0 +1,12 @@
+bazel_dep(name = "rules_oci", version = "0.0.0")
+bazel_dep(name = "aspect_bazel_lib", version = "2.7.2")
+bazel_dep(name = "bazel_skylib", version = "1.5.0")
+bazel_dep(name = "platforms", version = "0.0.8")
+bazel_dep(name = "rules_rust", version = "0.45.1")
+bazel_dep(name = "rules_pkg", version = "0.10.1")
+bazel_dep(name = "hermetic_cc_toolchain", version = "3.1.0")
+
+local_path_override(
+    module_name = "rules_oci",
+    path = "../..",
+)