Rework Github Actions CI

We use a docker-based workflow to get consistent runs. Note that we use
stretch images for newer ruby versions and do some ssl hackery - more
recent debian versions see SSL test failures related to unsupported
ciphers, etc. Rather than debug them now, we ignore them - they're not
likely related directly to the code we're testing.

We also hack up the ruby docker image; because they do this strange
thing where they install gems globally into one bundle. It messes up
this build process, so we undo it to the best of our ability.

.dockerignore

@@ -0,0 +1,80 @@
+*.rbc
+/.config
+/coverage/
+/InstalledFiles
+/pkg/
+/spec/reports/
+/spec/examples.txt
+/test/tmp/
+/test/version_tmp/
+/tmp/
+
+# Used by dotenv library to load environment variables.
+# .env
+
+## Specific to RubyMotion:
+.dat*
+.repl_history
+build/
+*.bridgesupport
+build-iPhoneOS/
+build-iPhoneSimulator/
+
+## Specific to RubyMotion (use of CocoaPods):
+#
+# We recommend against adding the Pods directory to your .gitignore. However
+# you should judge for yourself, the pros and cons are mentioned at:
+# https://guides.cocoapods.org/using/using-cocoapods.html#should-i-check-the-pods-directory-into-source-control
+#
+# vendor/Pods/
+
+## Documentation cache and generated files:
+/.yardoc/
+/_yardoc/
+/rdoc/
+
+## Environment normalization:
+/.bundle/
+/vendor/bundle
+/lib/bundler/man/
+
+# for a library or gem, you might want to ignore these files since the code is
+# intended to run in multiple environments; otherwise, check them in:
+# Gemfile.lock
+# .ruby-version
+# .ruby-gemset
+
+# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
+.rvmrc
+
+# Specifics for octocatalog-diff
+bin/bundler
+bin/facter
+bin/hiera
+bin/htmldiff
+bin/httparty
+bin/ldiff
+bin/parallel_cucumber
+bin/parallel_rspec
+bin/parallel_spinach
+bin/parallel_test
+bin/puppet
+bin/rake
+bin/rspec
+bin/rubocop
+bin/ruby-parse
+bin/ruby-rewrite
+bin/safe_yaml
+
+# Ignore config created during testing
+.puppet_version
+.parallel_runtime_rspec.log
+.parallel_runtime_integration.log
+.parallel_runtime_tests.log
+.rspec_parallel
+
+# Packaged gem
+/pkg/
+Gemfile.lock
+
+.git

.github/workflows/main.yml

@@ -2,6 +2,11 @@ name: CI
 on: [push]
 jobs:
   puppet-3-8-7:
+    env:
+      PUPPET_VERSIONS: "3.8.7"
+      PUPPET_VERSION: "3.8.7"
+      RUBOCOP_TEST: false
+      RSPEC_TEST: true
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -9,22 +14,17 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v1
-      - name: bundle
-        run: |          
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "3.8.7" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: rspec
-        run: |
-          bundle exec rspec spec/octocatalog-diff/tests
-          bundle exec rspec spec/octocatalog-diff/integration
-    container:
-      image: ruby:${{matrix.ruby-version}}
-      env:
-        PUPPET_VERSION: "3.8.7"
+      - name: Build container
+        run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}}
+      - name: Tests
+        run: docker run -e PUPPET_VERSION -e PUPPET_VERSIONS -e RSPEC_TEST -e RUBOCOP_TEST -e ENFORCE_COVERAGE octocatalog-diff:ruby${{matrix.ruby-version}} /app/script/cibuild
 
   puppet-4-10-10:
+    env:
+      PUPPET_VERSIONS: "4.10.10"
+      PUPPET_VERSION: "4.10.10"
+      RUBOCOP_TEST: false
+      RSPEC_TEST: true
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -32,22 +32,17 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v1
-      - name: bundle
-        run: |
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "4.10.10" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: spec
-        run: |
-          bundle exec rspec spec/octocatalog-diff/tests
-          bundle exec rspec spec/octocatalog-diff/integration
-    container:
-      image: ruby:${{matrix.ruby-version}}
-      env:
-        PUPPET_VERSION: "4.10.10"
+      - name: Build container
+        run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}}
+      - name: Tests
+        run: docker run -e PUPPET_VERSION -e PUPPET_VERSIONS -e RSPEC_TEST -e RUBOCOP_TEST -e ENFORCE_COVERAGE octocatalog-diff:ruby${{matrix.ruby-version}} /app/script/cibuild
 
   puppet-5-5-8:
+    env:
+      PUPPET_VERSIONS: "5.5.8"
+      PUPPET_VERSION: "5.5.8"
+      RUBOCOP_TEST: false
+      RSPEC_TEST: true
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -55,56 +50,13 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v1
-      - name: bundle
-        run: |
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "5.5.8" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: rspec
-        run: |
-          bundle exec rspec spec/octocatalog-diff/tests
-          bundle exec rspec spec/octocatalog-diff/integration
-    container:
-      image: ruby:${{matrix.ruby-version}}
-      env:
-        PUPPET_VERSION: "5.5.8"
-
-  rubocop:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v1
-      - name: bundle
-        run: |
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "5.5.8" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: rubocop
-        run: bundle exec rake rubocop
-    container:
-      image: "ruby:2.6"
-      env:
-        PUPPET_VERSION: "5.5.8"
-
-  coverage:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v1
-      - name: bundle
-        run: |
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "5.5.8" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: rubocop
-        run: |
-          bundle exec rspec spec/octocatalog-diff/tests
-          grep -q "100% test coverage. You're all set, friend" coverage/coverage.txt
-    container:
-      image: "ruby:2.6"
-      env:
-        PUPPET_VERSION: "5.5.8"
-        COVERAGE: true
+      - name: Build container
+        run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}}-stretch
+      - name: Tests
+        run: docker run -e PUPPET_VERSION -e PUPPET_VERSIONS -e RSPEC_TEST -e RUBOCOP_TEST -e ENFORCE_COVERAGE octocatalog-diff:ruby${{matrix.ruby-version}} /app/script/cibuild
+      - name: Rubocop and Coverage
+        run: docker run -e PUPPET_VERSION -e PUPPET_VERSIONS -e RSPEC_TEST -e RUBOCOP_TEST -e ENFORCE_COVERAGE octocatalog-diff:ruby${{matrix.ruby-version}} /app/script/cibuild
+        if: matrix.ruby-version == '2.6'
+        env:
+          RUBOCOP_TEST: true
+          ENFORCE_COVERAGE: true

Dockerfile

@@ -0,0 +1,18 @@
+ARG RUBY_VERSION="2.6"
+FROM ruby:${RUBY_VERSION} as ruby
+ARG RUBY_VERSION
+ENV RUBY_VERSION="${RUBY_VERSION}"
+RUN rm -rf $GEM_HOME $BUNDLE_PATH $BUNDLE_BIN $BUNDLE_APP_CONFIG
+RUN apt-get update && apt-get install -y cmake openssl libssl-dev
+RUN sed -i'' -e 's/CipherString = DEFAULT@SECLEVEL=2/CipherString = DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf
+RUN sed -i'' -e 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /etc/ssl/openssl.cnf
+
+FROM scratch AS app
+COPY --from=ruby / /
+WORKDIR /app
+ENV LANG="C.UTF-8"
+COPY . .
+#RUN gem install bundler -v 1.17.2
+RUN script/bootstrap
+
+CMD ["/app/script/cibuild"]