From cc137b81d3f7691cbaf81c534ec352b25e6f7cda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dario=20Casta=C3=B1=C3=A9?= Date: Fri, 24 Jul 2026 21:52:01 +0200 Subject: [PATCH] ci: pin container images by digest and extend Dependabot to docker-compose GitHub recently made the Dependabot cooldown default 3 days; this makes it explicit at 2 days everywhere, and closes the gaps that let images drift without Dependabot tracking them: - Add docker-compose ecosystems (Dependabot only tracks Dockerfiles under `docker`, not Compose files) for the local dev stack and a new CI-only test-images group, with digest-only ignore rules for intentionally-pinned old test versions. - Pin every trackable image (`contrib/*` and `internal/apps` Dockerfiles, all docker-compose.yaml files) to its @sha256 digest. - Move the CI workflow's native `services:` blocks into .github/testservices/docker-compose.yaml, since GitHub Actions services/container image refs aren't parsed by Dependabot (dependabot-core#5819). - Replace hardcoded Testcontainers image literals across the orchestrion integration suite with a single embedded catalog (instrumentation/testutils/containers/images/docker-compose.yaml + Image() helper), so those digests are Dependabot-tracked too instead of living only in Go string literals synced by hand. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 93 +++++++- .github/testservices/docker-compose.yaml | 189 ++++++++++++++++ .github/workflows/orchestrion.yml | 13 +- .github/workflows/unit-integration-tests.yml | 206 +++--------------- .../apim-callout/cmd/apim-callout/Dockerfile | 4 +- .../cmd/serviceextensions/Dockerfile | 4 +- .../cmd/spoa/Dockerfile | 4 +- .../gateway-api/cmd/request-mirror/Dockerfile | 4 +- docker-compose.yaml | 2 +- .../testutils/containers/aerospike.go | 2 +- .../testutils/containers/aws-dynamodb.go | 2 +- instrumentation/testutils/containers/go.mod | 2 +- .../testutils/containers/images.go | 52 +++++ .../containers/images/docker-compose.yaml | 49 +++++ instrumentation/testutils/containers/kafka.go | 2 +- .../testutils/containers/mongodb.go | 2 +- instrumentation/testutils/containers/redis.go | 2 +- .../testutils/containers/valkey.go | 2 +- internal/apps/Dockerfile | 2 +- internal/apps/docker-compose.yml | 2 +- internal/apps/staleidle-soak/compose.yml | 2 +- .../_integration/go-elasticsearch/base.go | 9 +- .../_integration/go-elasticsearch/v6.go | 4 +- .../_integration/go-elasticsearch/v7.go | 4 +- .../_integration/go-elasticsearch/v8.go | 4 +- .../orchestrion/_integration/gocql/base.go | 2 +- internal/orchestrion/_integration/pgx/pgx.go | 2 +- .../orchestrion/_integration/vault/vault.go | 2 +- 28 files changed, 440 insertions(+), 227 deletions(-) create mode 100644 .github/testservices/docker-compose.yaml create mode 100644 instrumentation/testutils/containers/images.go create mode 100644 instrumentation/testutils/containers/images/docker-compose.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f8f3ed24837..b82a6cf6dd6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -32,12 +32,12 @@ updates: # Docker — updates base image digests (sha256 pins) to latest verified digests. - package-ecosystem: "docker" directories: + - "/.gitlab/benchmarks/micro/container" - "/contrib/azure/apim-callout/cmd/apim-callout" - "/contrib/envoyproxy/go-control-plane/cmd/serviceextensions" - "/contrib/haproxy/stream-processing-offload/cmd/spoa" - "/contrib/k8s.io/gateway-api/cmd/request-mirror" - "/internal/apps" - - "/internal/setup-smoke-test" schedule: interval: "weekly" day: "monday" @@ -54,12 +54,87 @@ updates: - "dependencies" cooldown: default-days: 2 + + # Docker Compose (dev/local) — updates image digests in the local-development + # stacks. Version/tag upgrades are allowed here; maintainers curate them. + - package-ecosystem: "docker-compose" + directories: + - "/" + - "/internal/apps" + - "/internal/apps/staleidle-soak" + schedule: + interval: "weekly" + day: "monday" + time: "09:00" + timezone: "Europe/Paris" + groups: + docker-compose-dev: + patterns: + - "*" + open-pull-requests-limit: 5 + commit-message: + prefix: "chore(deps)" + labels: + - "dependencies" + cooldown: + default-days: 2 + + # Docker Compose (test images) — CI service containers and the Testcontainers + # image catalog intentionally pin specific (often old) versions to cover + # compatibility matrices. Only digests are refreshed; version/tag bumps are + # ignored so the test matrix doesn't silently drift. + - package-ecosystem: "docker-compose" + directories: + - "/.github/testservices" + - "/instrumentation/testutils/containers/images" + schedule: + interval: "weekly" + day: "monday" + time: "09:00" + timezone: "Europe/Paris" + groups: + docker-compose-test-images: + patterns: + - "*" + open-pull-requests-limit: 5 + commit-message: + prefix: "chore(deps)" + labels: + - "dependencies" + cooldown: + default-days: 2 ignore: - # amazonlinux:2 is pinned to a specific AL2 (glibc 2.26) digest and must - # never be upgraded to AL2023 (glibc 2.34). Omitting `versions` blocks - # ALL Dependabot updates for this image — both digest refreshes of :2 and - # any tag-change PR proposing :2023 — because a version-scoped rule like - # "= 2" would still permit a :2 → :2023 tag upgrade. The :2023 stage in - # the same Dockerfile is unpinned and always pulls the current :2023 at - # build time, so losing automated digest updates there is acceptable. - - dependency-name: "amazonlinux" + - dependency-name: "ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent" + update-types: &ignore-version-bumps ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"] + - dependency-name: "cassandra" + update-types: *ignore-version-bumps + - dependency-name: "cimg/mysql" + update-types: *ignore-version-bumps + - dependency-name: "cimg/postgres" + update-types: *ignore-version-bumps + - dependency-name: "mcr.microsoft.com/mssql/server" + update-types: *ignore-version-bumps + - dependency-name: "consul" + update-types: *ignore-version-bumps + - dependency-name: "redis" + update-types: *ignore-version-bumps + - dependency-name: "valkey/valkey" + update-types: *ignore-version-bumps + - dependency-name: "elasticsearch" + update-types: *ignore-version-bumps + - dependency-name: "docker.elastic.co/elasticsearch/elasticsearch" + update-types: *ignore-version-bumps + - dependency-name: "mongo" + update-types: *ignore-version-bumps + - dependency-name: "memcached" + update-types: *ignore-version-bumps + - dependency-name: "confluentinc/confluent-local" + update-types: *ignore-version-bumps + - dependency-name: "localstack/localstack" + update-types: *ignore-version-bumps + - dependency-name: "docker.io/postgres" + update-types: *ignore-version-bumps + - dependency-name: "vault" + update-types: *ignore-version-bumps + - dependency-name: "aerospike" + update-types: *ignore-version-bumps diff --git a/.github/testservices/docker-compose.yaml b/.github/testservices/docker-compose.yaml new file mode 100644 index 00000000000..7913256f23b --- /dev/null +++ b/.github/testservices/docker-compose.yaml @@ -0,0 +1,189 @@ +# CI service containers for .github/workflows/unit-integration-tests.yml. +# +# These used to be defined natively via the workflow's `services:` key. +# They live here instead so the `docker-compose` Dependabot ecosystem can +# keep every image digest fresh — GitHub Actions `services:`/`container:` +# image references are not tracked by Dependabot (dependabot-core#5819). +# +# `test-contrib-matrix` brings up the full stack; `test-core` brings up only +# `datadog-agent`. Several images are intentionally pinned to old versions to +# cover compatibility matrices (cassandra, redis, consul, elasticsearch, +# memcached, mysql/postgres via cimg) — see the `ignore` rules in +# .github/dependabot.yml, which restrict Dependabot to digest-only refreshes +# for these. + +services: + datadog-agent: + image: registry.datadoghq.com/agent:latest@sha256:44bfe2c475d9467e78e73e4327148d7e3902da5a48cbb1b0f6b84b01283e89d5 + environment: + DD_HOSTNAME: "github-actions-worker" + DD_APM_ENABLED: "true" + DD_BIND_HOST: "0.0.0.0" + DD_API_KEY: "invalid_key_but_this_is_fine" + DD_TEST_AGENT_HOST: "localhost" + DD_TEST_AGENT_PORT: "9126" + healthcheck: + test: ["CMD-SHELL", "bash -c '- - --health-cmd "bash -c '- - --health-cmd "bash -c '- - --name "kafka" - localstack: - image: localstack/localstack:4.14.0@sha256:3ebc37595918b8accb852f8048fef2aff047d465167edd655528065b07bc364a - ports: - - 4566:4566 - aerospike: - image: aerospike:ce-7.2.0.6@sha256:79c30951edab8878b14b650f32db416106a21d458be994344e488756fe8b651f - ports: - - 3000:3000 steps: - name: Restore repo cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -233,12 +80,21 @@ jobs: ref: ${{ github.sha }} clean: false + - name: Start CI service containers + run: docker compose up -d + - name: Setup Go and development tools uses: ./.github/actions/setup-go with: go-version: ${{ inputs.go-version }} tools-dir: ${{ github.workspace }}/_tools tools-bin: ${{ github.workspace }}/bin + + # Containers were started (non-blocking) before Go setup above, so most of + # the wait time already overlapped with it; this just waits out whatever's left. + - name: Wait for CI service containers + run: docker compose up -d --wait --wait-timeout 120 + - name: Test Contrib if: always() env: @@ -289,7 +145,7 @@ jobs: - name: Get Datadog APM Test Agent Logs if: always() shell: bash - run: docker logs ${{ job.services.testagent.id }} + run: docker compose logs testagent - name: Get Datadog APM Test Agent Trace Check Summary Results if: always() @@ -320,6 +176,10 @@ jobs: retention-days: 1 if-no-files-found: ignore + - name: Stop CI service containers + if: always() + run: docker compose down + test-contrib: needs: - test-contrib-matrix @@ -384,23 +244,9 @@ jobs: runs-on: group: "APM Larger Runners" env: - INTEGRATION: true - services: - datadog-agent: - image: registry.datadoghq.com/agent:latest - env: - DD_HOSTNAME: "github-actions-worker" - DD_APM_ENABLED: true - DD_BIND_HOST: "0.0.0.0" - DD_API_KEY: "invalid_key_but_this_is_fine" - # We need to specify a custom health-check. By default, this container will remain "unhealthy" since - # we don't fully configure it with a valid API key (and possibly other reasons) - # This command just checks for our ability to connect to port 8126 - options: >- - --health-cmd "bash -c ' ../../.. diff --git a/instrumentation/testutils/containers/images.go b/instrumentation/testutils/containers/images.go new file mode 100644 index 00000000000..a8687f7ad03 --- /dev/null +++ b/instrumentation/testutils/containers/images.go @@ -0,0 +1,52 @@ +// Unless explicitly stated otherwise all files in this repository are licensed +// under the Apache License Version 2.0. +// This product includes software developed at Datadog (https://www.datadoghq.com/). +// Copyright 2023-present Datadog, Inc. + +//go:build linux || !githubci + +package containers + +import ( + _ "embed" + "fmt" + "sync" + + "gopkg.in/yaml.v3" +) + +//go:embed images/docker-compose.yaml +var imagesYAML []byte + +type imageCatalogEntry struct { + Image string `yaml:"image"` +} + +type imageCatalog struct { + Services map[string]imageCatalogEntry `yaml:"services"` +} + +var ( + imagesOnce sync.Once + images imageCatalog +) + +// Image returns the pinned image reference (including its @sha256 digest) for the given catalog +// key, as defined in images/docker-compose.yaml. That file is the single source of truth for every +// Testcontainers image used by this package and the orchestrion integration suite, and is the only +// thing Dependabot's docker-compose ecosystem needs to track to keep digests fresh. +// +// It panics on an unknown key: a lookup miss here is always a programming error, never a runtime +// condition a caller should handle. +func Image(name string) string { + imagesOnce.Do(func() { + if err := yaml.Unmarshal(imagesYAML, &images); err != nil { + panic(fmt.Sprintf("containers: failed to parse images/docker-compose.yaml: %s", err)) + } + }) + svc, ok := images.Services[name] + if !ok { + panic(fmt.Sprintf("containers: no image catalog entry named %q", name)) + } + return svc.Image +} diff --git a/instrumentation/testutils/containers/images/docker-compose.yaml b/instrumentation/testutils/containers/images/docker-compose.yaml new file mode 100644 index 00000000000..31716a90572 --- /dev/null +++ b/instrumentation/testutils/containers/images/docker-compose.yaml @@ -0,0 +1,49 @@ +# Image catalog for Testcontainers-based tests (this package and the +# orchestrion integration suite). Never `up`'d as a stack — the only field +# that matters per service is `image:`. It exists so the `docker-compose` +# Dependabot ecosystem can keep every digest fresh; Go code reads the image +# strings via the embedded-and-parsed Image() helper in images.go, and +# .github/workflows/orchestrion.yml's pre-pull step reads the same file. + +services: + dynamodb: + image: amazon/dynamodb-local:latest@sha256:d89f8fcc6b1a39cb35976c248ed42a28c66ae00dc043099210f5571e42648ab4 + + postgres: + image: docker.io/postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777 + + vault: + image: vault:1.7.3@sha256:55d8cb0a995c0e4a4426b9f00c8944583700edb35917d2d950ed9b2379e61830 + + cassandra: + image: cassandra:4.1@sha256:d25e8ee78d648fade002d0d176b7e8c953c69164b9f316ccbccf62f524c9dfbf + + elasticsearch6: + image: docker.elastic.co/elasticsearch/elasticsearch:6.8.23@sha256:ca5dac2352e09263e55cccac445d69a0d2eec9c8c26a4c95c3b1430de1f427f2 + + elasticsearch7: + image: docker.elastic.co/elasticsearch/elasticsearch:7.17.24@sha256:70a20649aef54770cc31e59fd91c79cbc00cb6b9ea6c92015bad995b965f8f4c + + elasticsearch8: + image: docker.elastic.co/elasticsearch/elasticsearch:8.15.3@sha256:01c1732062b4a846c5ca687b0094b89bad0bfed00c6d71626db32fb8f3131a78 + + redis: + image: redis:7-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99 + + valkey: + image: valkey/valkey:8-alpine@sha256:a038175878d66b9d274fbf8be73c0305e93798b83917647f167e18cef3c71eec + + # Intentionally kept in lockstep with the same-named entry in + # .github/testservices/docker-compose.yaml (unlike the other entries here, + # which pin different versions for different test purposes). Dependabot + # scans both files independently, so a digest bump to one won't + # automatically update the other — keep them in sync manually. + kafka: + image: confluentinc/confluent-local:7.5.0@sha256:8e391de42cfcd3498e7317dcf159790f1f1cc3f3ffce900b30d7da23888687fd + + mongo: + image: mongo:8@sha256:e0ce8c35124d4a9f9785532d1f268f39e9728ffa1cb38f46fa482436424c4bd3 + + # See the "kept in lockstep" note on kafka above — applies here too. + aerospike: + image: aerospike:ce-7.2.0.6@sha256:79c30951edab8878b14b650f32db416106a21d458be994344e488756fe8b651f diff --git a/instrumentation/testutils/containers/kafka.go b/instrumentation/testutils/containers/kafka.go index 65b944058e3..d47e31ad2b0 100644 --- a/instrumentation/testutils/containers/kafka.go +++ b/instrumentation/testutils/containers/kafka.go @@ -34,7 +34,7 @@ func StartKafkaTestContainer(t testing.TB, topics []string) (*kafka.KafkaContain } container, err := kafka.Run(ctx, - "confluentinc/confluent-local:7.5.0", // Change the docker pull stage in .github/workflows/orchestrion.yml if you update this + Image("kafka"), kafka.WithClusterID("test-cluster"), WithTestLogConsumer(t), testcontainers.WithWaitStrategy(wait.ForAll(waitStrategies...)), diff --git a/instrumentation/testutils/containers/mongodb.go b/instrumentation/testutils/containers/mongodb.go index 6ac953b489f..5244d2f637d 100644 --- a/instrumentation/testutils/containers/mongodb.go +++ b/instrumentation/testutils/containers/mongodb.go @@ -35,7 +35,7 @@ func StartMongoDBTestContainer(t testing.TB) (*mongodb.MongoDBContainer, string) }), } container, err := mongodb.Run(ctx, - "mongo:8", + Image("mongo"), opts..., ) AssertTestContainersError(t, err) diff --git a/instrumentation/testutils/containers/redis.go b/instrumentation/testutils/containers/redis.go index 98b9dda3d26..b456d163c97 100644 --- a/instrumentation/testutils/containers/redis.go +++ b/instrumentation/testutils/containers/redis.go @@ -50,7 +50,7 @@ func StartRedisTestContainer(t testing.TB) (*redis.RedisContainer, string) { }), } container, err := redis.Run(ctx, - "redis:7-alpine", // Change the docker pull stage in .github/workflows/orchestrion.yml if you update this + Image("redis"), opts..., ) AssertTestContainersError(t, err) diff --git a/instrumentation/testutils/containers/valkey.go b/instrumentation/testutils/containers/valkey.go index 3b9db8b4f01..2bf49c2ecda 100644 --- a/instrumentation/testutils/containers/valkey.go +++ b/instrumentation/testutils/containers/valkey.go @@ -50,7 +50,7 @@ func StartValkeyTestContainer(t testing.TB) (*testvalkey.ValkeyContainer, string }), } - container, err := testvalkey.Run(ctx, "valkey/valkey:8-alpine", opts...) + container, err := testvalkey.Run(ctx, Image("valkey"), opts...) AssertTestContainersError(t, err) RegisterContainerCleanup(t, container) diff --git a/internal/apps/Dockerfile b/internal/apps/Dockerfile index 15529b1b1fa..7f18b51fa52 100644 --- a/internal/apps/Dockerfile +++ b/internal/apps/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.4 +FROM golang:1.26.4@sha256:f96cc555eb8db430159a3aa6797cd5bae561945b7b0fe7d0e284c63a3b291609 COPY . /dd-trace-go WORKDIR /dd-trace-go/internal/apps # -t will download all dependencies, including test dependencies diff --git a/internal/apps/docker-compose.yml b/internal/apps/docker-compose.yml index 6db5a077dad..6c45da66c64 100644 --- a/internal/apps/docker-compose.yml +++ b/internal/apps/docker-compose.yml @@ -11,7 +11,7 @@ services: agent: condition: service_healthy agent: - image: datadog/agent:latest + image: datadog/agent:latest@sha256:44bfe2c475d9467e78e73e4327148d7e3902da5a48cbb1b0f6b84b01283e89d5 network_mode: host healthcheck: interval: 1s # default is 30s which would slow "app", see https://github.com/DataDog/datadog-agent/blob/5533bb9c0c23dab6ff2166f75a7ff244ae65f237/Dockerfiles/agent/amd64/Dockerfile#LL200C14-L200C27 diff --git a/internal/apps/staleidle-soak/compose.yml b/internal/apps/staleidle-soak/compose.yml index e52da532cd6..9430f11bd59 100644 --- a/internal/apps/staleidle-soak/compose.yml +++ b/internal/apps/staleidle-soak/compose.yml @@ -14,7 +14,7 @@ services: agent: - image: datadog/agent:7.77.1 + image: datadog/agent:7.77.1@sha256:25dfd0ce2c76e8b40bf52941b9f8b79d9d0fd056e46846c236547da49b20e2bf container_name: staleidle-soak-agent # Run as root inside the container so the UDS socket the agent creates # under /var/run/datadog/ is host-readable/writable regardless of the diff --git a/internal/orchestrion/_integration/go-elasticsearch/base.go b/internal/orchestrion/_integration/go-elasticsearch/base.go index 65c563033b4..204a645bb9d 100644 --- a/internal/orchestrion/_integration/go-elasticsearch/base.go +++ b/internal/orchestrion/_integration/go-elasticsearch/base.go @@ -13,7 +13,6 @@ import ( "encoding/json" "io" "net/http" - "strings" "testing" "time" @@ -37,15 +36,9 @@ type base struct { client esClient } -func (b *base) Setup(ctx context.Context, t *testing.T, image string, newClient func(addr string, caCert []byte) (esClient, error)) { +func (b *base) Setup(ctx context.Context, t *testing.T, containerName, image string, newClient func(addr string, caCert []byte) (esClient, error)) { containers.SkipIfProviderIsNotHealthy(t) - parts := strings.Split(image, ":") - require.Len(t, parts, 2) - version := parts[1] - major := strings.Split(version, ".")[0] - containerName := "elasticsearch" + major - var err error b.container, err = testelasticsearch.Run(ctx, image, diff --git a/internal/orchestrion/_integration/go-elasticsearch/v6.go b/internal/orchestrion/_integration/go-elasticsearch/v6.go index cfb97dc3796..6f15681c509 100644 --- a/internal/orchestrion/_integration/go-elasticsearch/v6.go +++ b/internal/orchestrion/_integration/go-elasticsearch/v6.go @@ -13,6 +13,7 @@ import ( "runtime" "testing" + "github.com/DataDog/dd-trace-go/instrumentation/testutils/containers/v2" "github.com/elastic/go-elasticsearch/v6" "github.com/elastic/go-elasticsearch/v6/esapi" "github.com/stretchr/testify/require" @@ -31,8 +32,7 @@ func (tc *TestCaseV6) Setup(ctx context.Context, t *testing.T) { } else if runtime.GOOS == "darwin" && runtime.GOARCH != "amd64" { t.Skip("Skipping test as the official elasticsearch v6 docker image cannot run under rosetta") } - // Change the docker pull stage in .github/workflows/orchestrion.yml if you update this - tc.base.Setup(ctx, t, "docker.elastic.co/elasticsearch/elasticsearch:6.8.23", func(addr string, _ []byte) (esClient, error) { + tc.base.Setup(ctx, t, "elasticsearch6", containers.Image("elasticsearch6"), func(addr string, _ []byte) (esClient, error) { return elasticsearch.NewClient(elasticsearch.Config{ Addresses: []string{addr}, }) diff --git a/internal/orchestrion/_integration/go-elasticsearch/v7.go b/internal/orchestrion/_integration/go-elasticsearch/v7.go index 6a3d5595149..cfd26265e7d 100644 --- a/internal/orchestrion/_integration/go-elasticsearch/v7.go +++ b/internal/orchestrion/_integration/go-elasticsearch/v7.go @@ -12,6 +12,7 @@ import ( "io" "testing" + "github.com/DataDog/dd-trace-go/instrumentation/testutils/containers/v2" "github.com/elastic/go-elasticsearch/v7" "github.com/elastic/go-elasticsearch/v7/esapi" "github.com/stretchr/testify/require" @@ -22,8 +23,7 @@ type TestCaseV7 struct { } func (tc *TestCaseV7) Setup(ctx context.Context, t *testing.T) { - // Change the docker pull stage in .github/workflows/orchestrion.yml if you update this - tc.base.Setup(ctx, t, "docker.elastic.co/elasticsearch/elasticsearch:7.17.24", func(addr string, _ []byte) (esClient, error) { + tc.base.Setup(ctx, t, "elasticsearch7", containers.Image("elasticsearch7"), func(addr string, _ []byte) (esClient, error) { return elasticsearch.NewClient(elasticsearch.Config{ Addresses: []string{addr}, }) diff --git a/internal/orchestrion/_integration/go-elasticsearch/v8.go b/internal/orchestrion/_integration/go-elasticsearch/v8.go index 01735ad254e..055d9f40fd0 100644 --- a/internal/orchestrion/_integration/go-elasticsearch/v8.go +++ b/internal/orchestrion/_integration/go-elasticsearch/v8.go @@ -12,6 +12,7 @@ import ( "io" "testing" + "github.com/DataDog/dd-trace-go/instrumentation/testutils/containers/v2" "github.com/elastic/go-elasticsearch/v8" "github.com/elastic/go-elasticsearch/v8/esapi" "github.com/stretchr/testify/require" @@ -22,8 +23,7 @@ type TestCaseV8 struct { } func (tc *TestCaseV8) Setup(ctx context.Context, t *testing.T) { - // Change the docker pull stage in .github/workflows/orchestrion.yml if you update this - tc.base.Setup(ctx, t, "docker.elastic.co/elasticsearch/elasticsearch:8.15.3", func(addr string, caCert []byte) (esClient, error) { + tc.base.Setup(ctx, t, "elasticsearch8", containers.Image("elasticsearch8"), func(addr string, caCert []byte) (esClient, error) { return elasticsearch.NewClient(elasticsearch.Config{ Addresses: []string{addr}, }) diff --git a/internal/orchestrion/_integration/gocql/base.go b/internal/orchestrion/_integration/gocql/base.go index befc000cdce..24232546191 100644 --- a/internal/orchestrion/_integration/gocql/base.go +++ b/internal/orchestrion/_integration/gocql/base.go @@ -35,7 +35,7 @@ func (b *base) setup(ctx context.Context, t *testing.T) { var err error b.container, err = testcassandra.Run(ctx, - "cassandra:4.1", + containers.Image("cassandra"), testcontainers.WithLogger(tclog.TestLogger(t)), containers.WithTestLogConsumer(t), ) diff --git a/internal/orchestrion/_integration/pgx/pgx.go b/internal/orchestrion/_integration/pgx/pgx.go index a249a20502b..bc25f1914b6 100644 --- a/internal/orchestrion/_integration/pgx/pgx.go +++ b/internal/orchestrion/_integration/pgx/pgx.go @@ -35,7 +35,7 @@ func (tc *TestCase) Setup(ctx context.Context, t *testing.T) { var err error tc.container, err = testpostgres.Run(ctx, - "docker.io/postgres:16-alpine", // Change the docker pull stage in .github/workflows/orchestrion.yml if you update this + containers.Image("postgres"), testcontainers.WithLogger(tclog.TestLogger(t)), containers.WithTestLogConsumer(t), // https://golang.testcontainers.org/modules/postgres/#wait-strategies_1 diff --git a/internal/orchestrion/_integration/vault/vault.go b/internal/orchestrion/_integration/vault/vault.go index 29920cf6f02..e48cc10aedd 100644 --- a/internal/orchestrion/_integration/vault/vault.go +++ b/internal/orchestrion/_integration/vault/vault.go @@ -32,7 +32,7 @@ func (tc *TestCase) Setup(ctx context.Context, t *testing.T) { var err error tc.server, err = testvault.Run(ctx, - "vault:1.7.3", // Change the docker pull stage in .github/workflows/orchestrion.yml if you update this + containers.Image("vault"), testcontainers.WithLogger(tclog.TestLogger(t)), containers.WithTestLogConsumer(t), testvault.WithToken("root"),