Merge 'integration' to 'master'

.github/workflows/purge-images.yml

@@ -0,0 +1,23 @@
+name: Purge GitHub container registry.
+
+on:
+  workflow_dispatch:
+  # Runs daily at midnight
+  schedule:
+    - cron: '0 0 * * *'
+
+jobs:
+  purge-images:
+    name: Delete old untagged images from ghcr.io
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete all PR containers older than a week
+        uses: snok/container-retention-policy@v2
+        with:
+          image-names: verapdf-rest:pr*, rest:pr*
+          cut-off: 1 week ago UTC
+          account-type: org
+          org-name: veraPDF
+          keep-at-least: 1
+          untagged-only: false
+          token: ${{ secrets.PAT }}

.github/workflows/push-dockerhub.yml

@@ -0,0 +1,34 @@
+name: Publish Docker image
+
+on:
+  push:
+    branches: [ master ]
+
+jobs:
+  push_to_registry:
+    name: Push Docker image to Docker Hub
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: verapdf/rest
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: verapdf/rest:latest,verapdf/rest:v1.24.1
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/push-github.yml

@@ -0,0 +1,41 @@
+name: Publish image to GitHub Packages
+on:
+  push:
+    branches:
+      - 'integration'
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: veraPDF/rest
+
+jobs:
+  publish:
+    name: Build and push Docker image to GitHub packages
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for GitHub
+        id: meta
+        uses: docker/metadata-action@v2
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          file: Dockerfile
+          build-args: GH_CHECKOUT=integration
+          tags: ghcr.io/verapdf/rest:dev
+          labels: ${{ steps.meta.outputs.labels }}
+

.github/workflows/test-dkr-build.yml

@@ -0,0 +1,38 @@
+name: Build Docker test container
+
+on:
+  workflow_call
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: veraPDF/rest
+
+jobs:
+  push_to_registry:
+    name: Build and push Docker image to GitHub packages
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v2
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          file: Dockerfile_dev
+          tags: ghcr.io/verapdf/rest:pr-${{github.event.number}}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/test-dkr-image.yml

@@ -0,0 +1,22 @@
+name: Test Docker deployment
+
+on:
+  workflow_call
+
+jobs:
+  test:
+    name: Deploy and test image
+    runs-on: ubuntu-latest
+    container: ubuntu
+    services:
+      verarest:
+        image: ghcr.io/verapdf/rest:pr-${{ github.event.pull_request.number }}
+        ports:
+          - 8080:8080
+    steps:
+      - name: Install wget 
+        run: apt-get update; apt-get install wget -y
+      - name: Test Profiles endpoint
+        run: wget -O- http://verarest:8080/api/profiles
+      - name: Test 1B profile endpoint
+        run: wget -O- http://verarest:8080/api/profiles/1b

.github/workflows/test-pr.yml

@@ -0,0 +1,37 @@
+name: PR QA
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  build:
+    name: Checkout and Build
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        java-version: [8, 11, 16, 17]
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: JDK setup
+        uses: actions/setup-java@v3
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: 'temurin'
+          cache: maven
+
+      - name: Build with Maven
+        run: mvn --batch-mode --update-snapshots verify
+
+  docker_build:
+    name: Build a test Docker image and add to GH container registry
+    needs: [ build ]
+    uses: veraPDF/veraPDF-rest/.github/workflows/test-dkr-build.yml@integration
+
+  docker_test:
+    name: Deploy and test the image built in previous step
+    needs: [ docker_build ]
+    uses: veraPDF/veraPDF-rest/.github/workflows/test-dkr-image.yml@integration

.gitignore

@@ -1,6 +1,5 @@
+# Ignore Maven artifacts
 target/
-.idea/
-*.iml
 pom.xml.tag
 pom.xml.releaseBackup
 pom.xml.versionsBackup
@@ -10,8 +9,15 @@ dependency-reduced-pom.xml
 buildNumber.properties
 .mvn/timing.properties
 
+# Ignore VS code
+.vscode
+
 # Ignore Eclipse artifacts
 .project
 .settings
 .classpath
 bin/
+
+# Ignore IDEA files
+.idea/
+*.iml

Dockerfile

@@ -1,27 +1,68 @@
 # See https://docs.docker.com/engine/userguide/eng-image/multistage-build/
-
-FROM maven as builder
+# First build the app on a maven open jdk 11 container
+FROM maven:3.8.6-openjdk-11 as app-builder
 WORKDIR /build
+
+# A specifc git branch, tag or commit to build from, defaults to master (release build)
+ARG GH_CHECKOUT
+ENV GH_CHECKOUT=${GH_CHECKOUT:-master}
+
+# Clone the repo, checkout the revision and build the application
 RUN git clone https://github.com/veraPDF/veraPDF-rest.git
-RUN cd veraPDF-rest && git checkout integration && mvn clean package
 
+WORKDIR /build/veraPDF-rest
+RUN git checkout ${GH_CHECKOUT} && mvn clean package
+
+# Install dumb-init for process safety
+# https://github.com/Yelp/dumb-init
+RUN wget -O /usr/local/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v1.2.5/dumb-init_1.2.5_x86_64
+
+# Now build a Java JRE for the Alpine application image
+# https://github.com/docker-library/docs/blob/master/eclipse-temurin/README.md#creating-a-jre-using-jlink
+FROM eclipse-temurin:11 as jre-builder
 
-FROM openjdk:8-jre-alpine
+# Create a custom Java runtime
+RUN "$JAVA_HOME/bin/jlink" \
+         --add-modules java.base,java.logging,java.xml,java.management,java.sql,java.desktop,jdk.crypto.ec \
+         --strip-debug \
+         --no-man-pages \
+         --no-header-files \
+         --compress=2 \
+         --output /javaruntime
 
-ENV VERAPDF_REST_VERSION=0.1.0-SNAPSHOT
+# Now the final application image
+FROM debian:bullseye-slim
+
+# Set for additional arguments passed to the java run command, no default
+ARG JAVA_OPTS
+ENV JAVA_OPTS=$JAVA_OPTS
+# Specify the veraPDF REST version if you want to (to be used in build automation), default is 0.1.0-SNAPSHOT
+ARG VERAPDF_REST_VERSION
+ENV VERAPDF_REST_VERSION=${VERAPDF_REST_VERSION:-0.2.0-SNAPSHOT}
+
+COPY --from=app-builder /usr/local/bin/dumb-init /usr/local/bin/dumb-init
+RUN chmod +x /usr/local/bin/dumb-init
+
+# Copy the JRE from the previous stage
+ENV JAVA_HOME=/opt/java/openjdk
+ENV PATH "${JAVA_HOME}/bin:${PATH}"
+COPY --from=jre-builder /javaruntime $JAVA_HOME
 
 # Since this is a running network service we'll create an unprivileged account
 # which will be used to perform the rest of the work and run the actual service:
+RUN useradd --system --user-group --home-dir=/opt/verapdf-rest verapdf-rest
+RUN mkdir --parents /var/opt/verapdf-rest/logs && chown -R verapdf-rest:verapdf-rest /var/opt/verapdf-rest
 
-# Debian:
-# RUN useradd --system --user-group --home-dir=/opt/verapdf-rest verapdf-rest
-# Alpine / Busybox:
-RUN install -d -o root -g root -m 755 /opt && adduser -h /opt/verapdf-rest -S verapdf-rest
 USER verapdf-rest
 WORKDIR /opt/verapdf-rest
 
-COPY --from=builder /build/veraPDF-rest/target/verapdf-rest-${VERAPDF_REST_VERSION}.jar /opt/verapdf-rest/
-COPY --from=builder /build/veraPDF-rest/server.yml /opt/verapdf-rest/
+# Copy the application from the previous stage
+COPY --from=app-builder /build/veraPDF-rest/target/verapdf-rest-${VERAPDF_REST_VERSION}.jar /opt/verapdf-rest/
+# Copy the default configuration file
+COPY --from=app-builder /build/veraPDF-rest/server.yml /var/opt/verapdf-rest/config/
+COPY --from=app-builder /build/veraPDF-rest/config /opt/verapdf-rest/config/
 
+VOLUME /var/opt/verapdf-rest
 EXPOSE 8080
-ENTRYPOINT java -jar /opt/verapdf-rest/verapdf-rest-${VERAPDF_REST_VERSION}.jar server server.yml
+
+ENTRYPOINT dumb-init java $JAVA_OPTS -Djava.awt.headless=true -jar /opt/verapdf-rest/verapdf-rest-${VERAPDF_REST_VERSION}.jar server /var/opt/verapdf-rest/config/server.yml

Dockerfile_dev

@@ -0,0 +1,65 @@
+# See https://docs.docker.com/engine/userguide/eng-image/multistage-build/
+# First build the app on a maven open jdk 11 container
+FROM maven:3.8.6-openjdk-11 as dev-builder
+WORKDIR /build
+
+# Copy the current dev source branch to a local build dir
+COPY src/ /build/veraPDF-rest/src/
+COPY pom.xml /build/veraPDF-rest/
+
+WORKDIR /build/veraPDF-rest
+RUN mvn clean package
+
+# Install dumb-init for process safety
+# https://github.com/Yelp/dumb-init
+RUN wget -O /usr/local/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v1.2.5/dumb-init_1.2.5_x86_64
+
+# Now build a Java JRE for the Alpine application image
+# https://github.com/docker-library/docs/blob/master/eclipse-temurin/README.md#creating-a-jre-using-jlink
+FROM eclipse-temurin:11 as jre-builder
+
+# Create a custom Java runtime
+RUN "$JAVA_HOME/bin/jlink" \
+         --add-modules java.base,java.logging,java.xml,java.management,java.sql,java.desktop,jdk.crypto.ec \
+         --strip-debug \
+         --no-man-pages \
+         --no-header-files \
+         --compress=2 \
+         --output /javaruntime
+
+# Now the final application image
+FROM debian:bullseye-slim
+
+# Set for additional arguments passed to the java run command, no default
+ARG JAVA_OPTS
+ENV JAVA_OPTS=$JAVA_OPTS
+# Specify the veraPDF REST version if you want to (to be used in build automation), default is 0.1.0-SNAPSHOT
+ARG VERAPDF_REST_VERSION
+ENV VERAPDF_REST_VERSION=${VERAPDF_REST_VERSION:-0.2.0-SNAPSHOT}
+
+COPY --from=dev-builder /usr/local/bin/dumb-init /usr/local/bin/dumb-init
+RUN chmod +x /usr/local/bin/dumb-init
+
+# Copy the JRE from the previous stage
+ENV JAVA_HOME=/opt/java/openjdk
+ENV PATH "${JAVA_HOME}/bin:${PATH}"
+COPY --from=jre-builder /javaruntime $JAVA_HOME
+
+# Since this is a running network service we'll create an unprivileged account
+# which will be used to perform the rest of the work and run the actual service:
+RUN useradd --system --user-group --home-dir=/opt/verapdf-rest verapdf-rest
+RUN mkdir --parents /var/opt/verapdf-rest/logs && chown -R verapdf-rest:verapdf-rest /var/opt/verapdf-rest
+
+USER verapdf-rest
+
+WORKDIR /opt/verapdf-rest
+# Copy the application from the previous stage
+COPY --from=dev-builder /build/veraPDF-rest/target/verapdf-rest-${VERAPDF_REST_VERSION}.jar /opt/verapdf-rest/
+# Copy the default configuration file
+COPY server.yml /var/opt/verapdf-rest/config/
+COPY config /opt/verapdf-rest/config/
+
+VOLUME /var/opt/verapdf-rest
+EXPOSE 8080
+
+ENTRYPOINT dumb-init java $JAVA_OPTS -Djava.awt.headless=true -jar /opt/verapdf-rest/verapdf-rest-${VERAPDF_REST_VERSION}.jar server /var/opt/verapdf-rest/config/server.yml