Improved actions

.github/workflows/publish.yml

@@ -1,25 +1,54 @@
-### This workflow has access to secrets and a read-write token
-name: Publish
+name: Publish docker container
 on:
-  workflow_run:
-    branches: [master]
-    types: [completed]
-    workflows: [Validate]
   push:
+    branches: 
+      - master
     tags:
-      - '*'
+      - v*
+
+env:
+  TEST_TAG: ${{ github.repository }}:test
 
 jobs:
   publish:
     runs-on: ubuntu-latest
-    name: Publish
+    name: Publish to Docker Hub
     steps:
       - uses: actions/checkout@v4
+
+      - name: Run tests
+        uses: ./.github/workflows/validate.yml
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v6
+        with:
+          load: true
+          tags: ${{ env.TEST_TAG }}
+
+      - name: Get a free port
+        run: echo "PORT=$(scripts/get-free-port.sh)" >> $GITHUB_ENV
+
+      - name: Start the Docker container
+        run: docker run -d --rm --name test-container -p $PORT:9229 ${{ env.TEST_TAG }}
+
+      - name: Test 
+        run: scripts/smoke-test.sh
+
+      - name: Stop the Docker container
+        run: docker stop test-container
+
       - name: Load Docker metadata
         id: meta
         uses: docker/metadata-action@v5
@@ -29,11 +58,11 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=edge  
-      - name: build and push docker image
+            type=edge
+
+      - name: Push Docker image
         uses: docker/build-push-action@v6
         with:
-          context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/validate.yml

@@ -1,8 +1,7 @@
 name: Validate
 
 on:
-  push:
-    branches: [master]
+  workflow_call:
   pull_request:
 
 jobs:
@@ -46,7 +45,7 @@ jobs:
           node-version: 20
           cache: yarn
       - run: yarn install
-      - run: scripts/smoke-test
+      - run: scripts/local-smoke-test.sh
 
   integration_test:
     runs-on: ubuntu-latest
@@ -60,4 +59,4 @@ jobs:
           node-version: 20
           cache: yarn
       - run: yarn install
-      - run: yarn integration-test
+      - run: yarn integration-test

scripts/get-free-port.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+BASE_PORT=49152
+INCREMENT=1
+
+port=$BASE_PORT
+
+while [ -n "$(ss -tan4H "sport = $port")" ]; do
+  port=$((port+INCREMENT))
+done
+
+echo "$port"

scripts/smoke-test → scripts/local-smoke-test.sh

@@ -7,30 +7,27 @@
 # We run this in CI to prove the actual server can start. This catches some edge-cases where
 # everything else passes, but something in the compile produced invalid JavaScript.
 
-while
-  PORT=$(shuf -n 1 -i 49152-65535)
-  netstat -atun | grep -q "$PORT"
-do
-  continue
-done
+PORT=$(scripts/get-free-port.sh)
+
+echo Using port $PORT
 
 PORT=$PORT yarn start &
-PID=$!
+YARN_PID=$!
+
+trap "kill $YARN_PID" SIGINT
 
-trap "kill $PID" SIGINT
+PORT=$PORT scripts/smoke-test.sh
+EXIT_CODE=$?
 
-PORT=$PORT timeout --foreground -s TERM 30 bash -c \
-'while [[ ${STATUS_RECEIVED} != 200 ]];\
-  do STATUS_RECEIVED=$(curl -s -o /dev/null -L -w ''%{http_code}'' http://localhost:$PORT/health) && \
-  echo "received status: $STATUS_RECEIVED" && \
-  sleep 1;\
-done;
-echo success with status: $STATUS_RECEIVED'
-CURL_EXIT_CODE=$?
+kill $YARN_PID
 
+PID=$(lsof -i tcp:$PORT | awk 'NR!=1 {print $2}')
 kill $PID
 
-if [[ $CURL_EXIT_CODE -ne 0 ]]; then
+if [[ $EXIT_CODE -ne 0 ]]; then
   echo Failed to start in time >&2
   exit 1
+else
+  echo Test success
+  exit 0
 fi

scripts/smoke-test.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# This script polls the Cognito Local server until the /health endpoint
+# responds with a 200. If the server doesn't respond in time, or exits with a non-zero code, the
+# script will fail.
+#
+# We run this in CI to prove the actual server can start. This catches some edge-cases where
+# everything else passes, but something in the compile produced invalid JavaScript.
+
+wget --retry-connrefused --retry-on-http-error=404 --tries=30 -q --wait=1 --spider "http://localhost:$PORT/health"

src/bin/start.ts

@@ -3,6 +3,7 @@
 import { createDefaultServer } from "../server";
 import Pino from "pino";
 import PinoPretty from "pino-pretty";
+import process from "node:process";
 
 const logger = Pino(
   {
@@ -39,3 +40,6 @@ createDefaultServer(logger)
     logger.error(err);
     process.exit(1);
   });
+
+process.on("SIGTERM", () => process.exit(0));
+process.on("SIGINT", () => process.exit(0));