migrate to bats

.github/workflows/ci.yaml

@@ -29,7 +29,6 @@ jobs:
           - e2e/wasm
           - e2e/smoke
           - e2e/crane_as_registry
-          - e2e/auth
 
         bzlmodEnabled: [true, false]
         exclude:
@@ -87,9 +86,29 @@ jobs:
           # Bazelisk will download bazel to here, ensure it is cached between runs.
           XDG_CACHE_HOME: ~/.cache/bazel-repo
         run: bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc --bazelrc=.bazelrc test ${{ steps.set_bzlmod_flag.outputs.bzlmod_flag }} //...
+  test-auth:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup bats
+        uses: mig4/setup-bats@v1
+        with:
+          bats-version: "1.8.2"
 
-      - name: ./test.sh
-        working-directory: ${{ matrix.folder }}
-        # hashFiles returns an empty string if test.sh is absent
-        if: ${{ hashFiles(format('{0}/test.sh', matrix.folder)) != '' }}
-        run: ./test.sh ${{ steps.set_bzlmod_flag.outputs.bzlmod_flag }}
+      - name: Setup bats helpers
+        uses: brokenpip3/setup-bats-libs@0.0.3
+        with:
+          support-path: /usr/lib/bats/bats-support
+          support-version: "0.3.0"
+          assert-path: /usr/lib/bats/bats-assert
+          assert-version: "2.1.0"
+
+      - name: bats -r .
+        working-directory: e2e/auth
+        run: bats -r .
+
+      - name: bats -r . --enable_bzlmod
+        working-directory: e2e/auth
+        run: |
+          echo "build --enable_bzlmod" >> .bazelrc.user
+          bats -r .

e2e/auth/BUILD.bazel

@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 load("@bazel_gazelle//:def.bzl", "gazelle")
-load("@bazel_skylib//rules:build_test.bzl", "build_test")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
 
 # gazelle:prefix example.com/auth
 gazelle(
@@ -36,10 +36,15 @@ go_binary(
     visibility = ["//visibility:public"],
 )
 
-# a dummy test so that bazel test does not complain
-build_test(
-    name = "build_test",
-    targets = [
-        ":auth",
-    ],
+oci_image(
+    name = "empty",
+    architecture = "arm64",
+    os = "linux",
+)
+
+oci_push(
+    name = "push",
+    image = ":empty",
+    repository = "localhost/empty_image",
+    repotags = ["latest"],
 )

e2e/auth/MODULE.bazel

@@ -11,16 +11,9 @@ local_path_override(
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 
 oci.pull(
-    name = "distroless_static",
-    digest = "sha256:c3c3d0230d487c0ad3a0d87ad03ee02ea2ff0b3dcce91ca06a1019e07de05f12",
-    image = "http://localhost:1447/distroless/static",
-    platforms = [
-        "linux/amd64",
-        "linux/arm",
-        "linux/arm64",
-        "linux/ppc64le",
-        "linux/s390x",
-    ],
+    name = "empty_image",
+    digest = "sha256:2d4595bbc0fabeb1489b1071f56c26f44a2f495afaa9386ad7d24e7b3d8dfd3e",
+    image = "http://localhost:1447/empty_image"
 )
 
 use_repo(oci, "distroless_static")

e2e/auth/WORKSPACE

@@ -22,16 +22,9 @@ oci_register_toolchains(
 load("@rules_oci//oci:pull.bzl", "oci_pull")
 
 oci_pull(
-    name = "distroless_static",
-    digest = "sha256:c3c3d0230d487c0ad3a0d87ad03ee02ea2ff0b3dcce91ca06a1019e07de05f12",
-    image = "http://localhost:1447/distroless/static",
-    platforms = [
-        "linux/amd64",
-        "linux/arm",
-        "linux/arm64",
-        "linux/ppc64le",
-        "linux/s390x",
-    ],
+    name = "empty_image",
+    digest = "sha256:2d4595bbc0fabeb1489b1071f56c26f44a2f495afaa9386ad7d24e7b3d8dfd3e",
+    image = "http://localhost:1447/empty_image",
 )
 
 ############################################

e2e/auth/main.go

@@ -76,7 +76,7 @@ func main() {
 	reg := registry.New(registry.Logger(log.New(ioutil.Discard, "", log.LstdFlags)))
 	s := &http.Server{
 		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if r.RequestURI == "/v2/distroless/static/manifests/sha256:c3c3d0230d487c0ad3a0d87ad03ee02ea2ff0b3dcce91ca06a1019e07de05f12" {
+			if r.RequestURI == "/v2/empty_image/static/manifests/sha256:c3c3d0230d487c0ad3a0d87ad03ee02ea2ff0b3dcce91ca06a1019e07de05f12" {
 				currentAuth := Authn{Authorization: []string{}}
 				if r.Header["Authorization"] != nil {
 					currentAuth.Authorization = r.Header["Authorization"]

e2e/auth/test.bats

@@ -0,0 +1,103 @@
+bats_load_library "bats-support"
+bats_load_library "bats-assert"
+
+function setup_file() {
+    cd $BATS_TEST_DIRNAME
+
+    export PATH="$PATH:$BATS_TEST_DIRNAME/helpers/"
+
+    export ASSERT=$(mktemp)
+    echo "{}" > $ASSERT
+
+    bazel run :auth $ASSERT &
+    export REGISTRY_PID=$!
+    sleep 1
+    bazel run :push -- --repository localhost:1447/empty_image
+}
+
+function teardown_file() {
+    bazel shutdown
+    kill $REGISTRY_PID
+}
+
+
+function setup() {
+    export DOCKER_CONFIG=$(mktemp -d)
+    echo "{}" > $ASSERT
+}
+
+
+@test "plain text" {
+    cat > "$DOCKER_CONFIG/config.json" <<EOF
+{
+  "auths": {
+    "localhost:1447": { "username": "test", "password": "test" }
+  }
+}
+EOF
+    echo '{"Authorization": ["Basic dGVzdDp0ZXN0"]}' > $ASSERT
+    run bazel build @empty_image//... --repository_cache=$BATS_TEST_TMPDIR
+    assert_success
+}
+
+@test "plain text base64" {
+    cat > "$DOCKER_CONFIG/config.json" <<EOF
+{
+  "auths": {
+    "http://localhost:1447": { "auth": "dGVzdDp0ZXN0" }
+  }
+}
+EOF
+    echo '{"Authorization": ["Basic dGVzdDp0ZXN0"]}' > $ASSERT
+    run bazel build @empty_image//... --repository_cache=$BATS_TEST_TMPDIR
+    assert_success
+}
+
+@test "plain text https" {
+    cat > "$DOCKER_CONFIG/config.json" <<EOF
+{
+  "auths": {
+    "https://localhost:1447": { "username": "test", "password": "test" }
+  }
+}
+EOF
+    echo '{"Authorization": ["Basic dGVzdDp0ZXN0"]}' > $ASSERT
+    run bazel build @empty_image//... --repository_cache=$BATS_TEST_TMPDIR
+    assert_success
+}
+
+@test "credstore" {
+    cat > "$DOCKER_CONFIG/config.json" <<EOF
+{
+  "auths": { "localhost:1447": {} },
+  "credsStore": "oci"
+}
+EOF
+    echo '{"Authorization": ["Basic dGVzdGluZzpvY2k="]}' > $ASSERT
+    run bazel build @empty_image//... --repository_cache=$BATS_TEST_TMPDIR
+    assert_success
+}
+
+@test "credstore misbehaves" {
+    cat > "$DOCKER_CONFIG/config.json" <<EOF
+{
+  "auths": { "localhost:1447": {} },
+  "credsStore": "evil"
+}
+EOF
+    run bazel build @empty_image//... --repository_cache=$BATS_TEST_TMPDIR
+    assert_failure
+    assert_output -p "can't run at this time" "ERROR: credential helper failed:"
+}
+
+@test "credstore missing" {
+    cat > "$DOCKER_CONFIG/config.json" <<EOF
+{
+  "auths": { "localhost:1447": {} },
+  "credsStore": "missing"
+}
+EOF
+    run bazel build @empty_image//... --repository_cache=$BATS_TEST_TMPDIR
+    assert_failure
+    assert_output -p "exec: docker-credential-missing: not found" "ERROR: credential helper failed:"
+}

oci/private/auth_config_locator.bzl

@@ -41,7 +41,6 @@ def _get_auth_file_path(rctx):
 
 def _oci_auth_config_locator_impl(rctx):
     config_path = _get_auth_file_path(rctx)
-    config_path = None
     if not config_path:
         # rctx.execute is cached between bazel invocations. prefer it over print
         # to avoid spamming terminal. Also rctx.execute has a nicer output.