Merge branch 'main' into renovate.all-non-major-dependencies

.github/workflows/build.yml

@@ -28,27 +28,31 @@ on:
         required: true
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     outputs:
       digest: ${{ steps.build.outputs.digest }}
       context: ${{ steps.build.outputs.context }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4
+
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3
+
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3
         with:
           driver-opts: |
             image=moby/buildkit:v0.11.1
             network=host
+
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
         with:
           username: ${{ secrets.registry_user }}
           password: ${{ secrets.registry_password }}
+
       - id: build
         name: Build and push
         run: |

.github/workflows/cleanup.yml

@@ -4,10 +4,10 @@ on:
     - cron: "0 13 * * 0" # Every Sunday at 1PM UTC (9AM EST)
 jobs:
   clean:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4
       - uses: actions/setup-java@v3
         with:
           distribution: temurin

.github/workflows/description.yml

@@ -9,10 +9,10 @@ on:
       - ".github/workflows/dockerhub-description.yml"
 jobs:
   description:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4
 
       - name: Fix Relative Paths
         run: |

.github/workflows/grype.yml

@@ -18,9 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4
+
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
         with:
           username: ${{ secrets.registry_user }}
           password: ${{ secrets.registry_password }}
@@ -33,8 +34,8 @@ jobs:
         with:
           cache-read-only: false
           arguments: ${{ inputs.image }}:grype ${{ inputs.digest }} --info
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: Grype Reports
+          name: ${{ inputs.image }} Grype Reports
           path: build/**/*-grype.*

.github/workflows/release.yml

@@ -11,10 +11,10 @@ permissions:
 jobs:
   release:
     if: github.event.pull_request.merged == true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4
         with:
           fetch-depth: 0
       - name: install autotag binary

.github/workflows/tags.yml

@@ -11,7 +11,7 @@ on:
         value: ${{ jobs.tags.outputs.tags }}
 jobs:
   tags:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       tags: ${{ steps.tags.outputs.tags }}
     steps:

.github/workflows/test.yml

@@ -15,15 +15,17 @@ on:
         required: true
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4
+
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
         with:
           username: ${{ secrets.registry_user }}
           password: ${{ secrets.registry_password }}
+
       - uses: actions/setup-java@v3
         with:
           distribution: temurin

activemq/Dockerfile

@@ -36,3 +36,9 @@ COPY --link rootfs /
 
 RUN create-service-user.sh --name activemq && \
     cleanup.sh
+
+HEALTHCHECK CMD curl -s \
+    -u admin:"$(cat /var/run/s6/container_environment/ACTIVEMQ_WEB_ADMIN_PASSWORD)" \
+    -H origin:localhost \
+    "http://localhost:8161/api/jolokia/read/org.apache.activemq:type=Broker,brokerName=localhost,service=Health/CurrentStatus" \
+    | jq .value | grep -q Good

activemq/README.md

@@ -2,6 +2,8 @@
 
 Docker image for [ActiveMQ] version 5.18.6.
 
+Built from [Islandora-DevOps/isle-buildkit activemq](https://github.com/Islandora-DevOps/isle-buildkit/tree/main/activemq)
+
 Please refer to the [ActiveMQ Documentation] for more in-depth information.
 
 As a quick example this will bring up an instance of ActiveMQ, and allow you to

activemq/tests/ServiceHealthcheck/build.gradle.kts

@@ -0,0 +1 @@
+../../../ci/healthcheck.gradle.kts

activemq/tests/ServiceHealthcheck/docker-compose.yml

@@ -0,0 +1,15 @@
+---
+
+# Common to all services
+x-common: &common
+  restart: "no"
+
+name: activemq-servicehealthcheck
+services:
+  activemq:
+    <<: *common
+    image: ${ACTIVEMQ:-islandora/activemq:local}
+    volumes:
+      - ./test.sh:/test.sh # Test to run.
+    command:
+      - /test.sh # Run test and exit.

activemq/tests/ServiceHealthcheck/test.sh

@@ -0,0 +1,13 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+on_terminate() {
+    echo "Termination signal received. Exiting..."
+    exit 0
+}
+trap 'on_terminate' SIGTERM
+
+sleep 60
+
+# The kotlin check should be stopping this container
+exit 1

alpaca/README.md

@@ -2,6 +2,8 @@
 
 Docker image for [Alpaca] version 2.2.0.
 
+Built from [Islandora-DevOps/isle-buildkit alpaca](https://github.com/Islandora-DevOps/isle-buildkit/tree/main/alpaca)
+
 Please refer to the [Alpaca Documentation] for more in-depth information.
 
 ## Dependencies

base/README.md

@@ -3,6 +3,8 @@
 Base Docker image from which almost all others are derived. It is not meant to
 be run on its own.
 
+Built from [Islandora-DevOps/isle-buildkit base](https://github.com/Islandora-DevOps/isle-buildkit/tree/main/base)
+
 It's based off off [Alpine Linux], and includes [s6 overlay] and [confd].
 
 ## Dependencies

blazegraph/README.md

@@ -2,6 +2,8 @@
 
 Docker image for [Blazegraph] version 2.1.5.
 
+Built from [Islandora-DevOps/isle-buildkit blazegraph](https://github.com/Islandora-DevOps/isle-buildkit/tree/main/blazegraph)
+
 Please refer to the [Blazegraph Documentation] for more in-depth information.
 
 As a quick example this will bring up an instance of [Blazegraph], and allow you

cantaloupe/Dockerfile

@@ -83,9 +83,9 @@ ENV \
     CANTALOUPE_ENDPOINT_ADMIN_ENABLED="false" \
     CANTALOUPE_ENDPOINT_ADMIN_SECRET= \
     CANTALOUPE_ENDPOINT_ADMIN_USERNAME="admin" \
-    CANTALOUPE_ENDPOINT_API_ENABLED="false" \
+    CANTALOUPE_ENDPOINT_API_ENABLED="true" \
     CANTALOUPE_ENDPOINT_API_SECRET= \
-    CANTALOUPE_ENDPOINT_API_USERNAME= \
+    CANTALOUPE_ENDPOINT_API_USERNAME=islandora \
     CANTALOUPE_ENDPOINT_HEALTH_DEPENDENCY_CHECK="false" \
     CANTALOUPE_ENDPOINT_IIIF_1_ENABLED="false" \
     CANTALOUPE_ENDPOINT_IIIF_2_ENABLED="true" \
@@ -271,3 +271,7 @@ ENV \
     CANTALOUPE_TEMP_PATHNAME=
 
 COPY --link rootfs /
+
+HEALTHCHECK CMD curl -s \
+  -u "${CANTALOUPE_ENDPOINT_API_USERNAME}:$(cat /var/run/s6/container_environment/CANTALOUPE_ENDPOINT_API_SECRET)" \
+  http://localhost:8182/health | jq .color | grep -q GREEN

cantaloupe/README.md

@@ -2,6 +2,8 @@
 
 Docker image for [Cantaloupe] version 5.0.6.
 
+Built from [Islandora-DevOps/isle-buildkit cantaloupe](https://github.com/Islandora-DevOps/isle-buildkit/tree/main/cantaloupe)
+
 Please refer to the [Cantaloupe Documentation] for more in-depth information.
 
 As a quick example this will bring up an instance of [Cantaloupe], and allow you
@@ -65,9 +67,9 @@ additional settings, volumes, ports, etc.
 | CANTALOUPE_ENDPOINT_ADMIN_ENABLED                                                      | "false"                                                          |
 | CANTALOUPE_ENDPOINT_ADMIN_SECRET                                                       |                                                                  |
 | CANTALOUPE_ENDPOINT_ADMIN_USERNAME                                                     | "admin"                                                          |
-| CANTALOUPE_ENDPOINT_API_ENABLED                                                        | "false"                                                          |
-| CANTALOUPE_ENDPOINT_API_SECRET                                                         |                                                                  |
-| CANTALOUPE_ENDPOINT_API_USERNAME                                                       |                                                                  |
+| CANTALOUPE_ENDPOINT_API_ENABLED                                                        | "true"                                                           |
+| CANTALOUPE_ENDPOINT_API_SECRET                                                         | random 16 char string                                            |
+| CANTALOUPE_ENDPOINT_API_USERNAME                                                       | "islandora"                                                      |
 | CANTALOUPE_ENDPOINT_HEALTH_DEPENDENCY_CHECK                                            | "false"                                                          |
 | CANTALOUPE_ENDPOINT_IIIF_1_ENABLED                                                     | "false"                                                          |
 | CANTALOUPE_ENDPOINT_IIIF_2_ENABLED                                                     | "true"                                                           |

cantaloupe/rootfs/etc/s6-overlay/s6-rc.d/cantaloupe-defaults/type

@@ -0,0 +1 @@
+oneshot

cantaloupe/rootfs/etc/s6-overlay/s6-rc.d/cantaloupe-defaults/up

@@ -0,0 +1 @@
+/etc/s6-overlay/scripts/cantaloupe-defaults.sh

cantaloupe/rootfs/etc/s6-overlay/scripts/cantaloupe-defaults.sh

@@ -0,0 +1,9 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+set -ex
+
+# Set the default value for CANTALOUPE_ENDPOINT_API_SECRET if none provided.
+DEFAULT_SECRET=$(openssl rand -hex 16)
+cat <<EOF | /usr/local/bin/confd-import-environment.sh
+CANTALOUPE_ENDPOINT_API_SECRET="{{ getenv "CANTALOUPE_ENDPOINT_API_SECRET" "${DEFAULT_SECRET}" }}"
+EOF

cantaloupe/tests/ServiceHealthcheck/build.gradle.kts

@@ -0,0 +1 @@
+../../../ci/healthcheck.gradle.kts

cantaloupe/tests/ServiceHealthcheck/docker-compose.yml

@@ -0,0 +1,15 @@
+---
+
+# Common to all services
+x-common: &common
+  restart: "no"
+
+name: cantaloupe-servicehealthcheck
+services:
+  cantaloupe:
+    <<: *common
+    image: ${CANTALOUPE:-islandora/cantaloupe:local}
+    volumes:
+      - ./test.sh:/test.sh # Test to run.
+    command:
+      - /test.sh # Run test and exit.

cantaloupe/tests/ServiceHealthcheck/test.sh

@@ -0,0 +1,13 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+on_terminate() {
+    echo "Termination signal received. Exiting..."
+    exit 0
+}
+trap 'on_terminate' SIGTERM
+
+sleep 60
+
+# The kotlin check should be stopping this container
+exit 1

ci/healthcheck.gradle.kts

@@ -0,0 +1,55 @@
+import plugins.TestsPlugin.DockerComposeUp
+import plugins.TestsPlugin.DockerComposeUp.Companion.pool
+import java.lang.Thread.sleep
+import java.time.Duration.ofSeconds
+import java.util.concurrent.CompletableFuture.supplyAsync
+import java.io.ByteArrayOutputStream
+
+tasks.named<DockerComposeUp>("test") {
+    doFirst {
+        supplyAsync(
+            {
+                val maxAttempts = 20
+                val delayBetweenAttempts = 5000L // 5 seconds in milliseconds
+                var attempt = 0
+                var foundHealthyService = false
+
+                while (attempt < maxAttempts) {
+                    attempt++
+                    val outputStream = ByteArrayOutputStream()
+                    project.exec {
+                        commandLine = baseArguments + listOf("ps", "--all")
+                        standardOutput = outputStream
+                        workingDir = project.projectDir
+                    }
+                    val output = outputStream.toString()
+
+                    val healthyServicePattern = """(?m)^.+\s+.+\s+Up \d+ seconds \(healthy\).*$""".toRegex()
+                    foundHealthyService = output.lines().any { line ->
+                        healthyServicePattern.matches(line)
+                    }
+
+                    if (foundHealthyService) {
+                        println("Service is healthy. Exiting test...")
+                        project.exec {
+                            commandLine = baseArguments + listOf("stop")
+                            standardOutput = outputStream
+                            workingDir = project.projectDir
+                        }
+                        break
+                    }
+
+                    if (attempt < maxAttempts) {
+                        println("No healthy service found. Retrying in ${delayBetweenAttempts / 1000} seconds...")
+                        sleep(delayBetweenAttempts)
+                    }
+                }
+
+                // Throw an exception if no healthy service was found after all attempts
+                if (!foundHealthyService) {
+                    throw GradleException("No service is marked as healthy in docker compose ps output after $maxAttempts attempts.")
+                }
+            }, pool
+        )
+    }
+}

code-server/Dockerfile

@@ -99,3 +99,5 @@ RUN sed -i "/nginx:x:100:101:nginx:\/var\/lib\/nginx:\/sbin\/nologin/cnginx:x:10
     chown -R nginx:nginx /var/lib/nginx && \
     chmod a=r,u+w /etc/sudo.conf && \
     cleanup.sh
+
+HEALTHCHECK CMD curl -s http://localhost:8443/healthz | jq -re .status

code-server/README.md

@@ -2,6 +2,8 @@
 
 Docker image for [code-server] 4.8.3.
 
+Built from [Islandora-DevOps/isle-buildkit code-server](https://github.com/Islandora-DevOps/isle-buildkit/tree/main/code-server)
+
 Please refer to the [code-server Documentation] for more in-depth information.
 
 Allows for shared development environment hosted in the browser.

code-server/tests/ServiceHealthcheck/build.gradle.kts

@@ -0,0 +1 @@
+../../../ci/healthcheck.gradle.kts

code-server/tests/ServiceHealthcheck/docker-compose.yml

@@ -0,0 +1,15 @@
+---
+
+# Common to all services
+x-common: &common
+  restart: "no"
+
+name: code-server-servicehealthcheck
+services:
+  code-server:
+    <<: *common
+    image: ${CODE_SERVER:-islandora/code-server:local}
+    volumes:
+      - ./test.sh:/test.sh # Test to run.
+    command:
+      - /test.sh # Run test and exit.