38 lines
1.2 KiB
JavaScript
38 lines
1.2 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { describe, it } from "vitest";
|
|
import { inspectContainerFile } from "./verify-container-image-pins.mjs";
|
|
|
|
const digest = `sha256:${"a".repeat(64)}`;
|
|
|
|
describe("container image pin verification", () => {
|
|
it("accepts digest-pinned Compose and Docker references plus local stages", () => {
|
|
const source = [
|
|
`FROM node:24@${digest} AS base`,
|
|
"FROM base AS runtime",
|
|
"services:",
|
|
` api:\n image: registry.example/api:stable@${digest}`,
|
|
` configurable:\n image: \${IMAGE:-registry.example/app:1.0.0@${digest}}`,
|
|
].join("\n");
|
|
|
|
const result = inspectContainerFile(source, "Dockerfile");
|
|
|
|
assert.equal(result.failures.length, 0);
|
|
assert.equal(result.passes.length, 4);
|
|
});
|
|
|
|
it("rejects mutable tags in Compose and Dockerfiles", () => {
|
|
const source = [
|
|
"FROM alpine:3.20 AS base",
|
|
"services:",
|
|
" api:",
|
|
" image: registry.example/api:latest",
|
|
].join("\n");
|
|
|
|
const result = inspectContainerFile(source, "docker-compose.yml");
|
|
|
|
assert.equal(result.failures.length, 2);
|
|
assert.match(result.failures[0], /Docker base image/);
|
|
assert.match(result.failures[1], /Compose image/);
|
|
});
|
|
});
|