build: pin and verify image inputs

2026-07-26 09:24:44 +00:00
parent c094b1ee68
commit a38bbfbae2
17 changed files with 172 additions and 38 deletions
@@ -107,7 +107,12 @@ class TestEnsureBuilt(unittest.TestCase):

    def test_local_mode_builds_orchestrator_before_its_fc_image(self):
        with patch.dict(os.environ, {"BOT_BOTTLE_INFRA_BUILD": "local"}), \
-                patch.object(infra_vm.docker_mod, "build_image") as build:
+                patch.object(infra_vm.docker_mod, "build_image") as build, \
+                patch.object(
+                    infra_vm.docker_mod,
+                    "image_id",
+                    return_value="sha256:" + "a" * 64,
+                ) as image_id:
            infra_vm.ensure_built()
        tags = [c.args[0] for c in build.call_args_list]
        # orchestrator-fc is FROM orchestrator, so the base is built first.
@@ -116,6 +121,11 @@ class TestEnsureBuilt(unittest.TestCase):
        self.assertEqual(infra_vm._ORCHESTRATOR_FC_IMAGE, tags[-1])
        self.assertLess(tags.index(infra_vm._ORCHESTRATOR_IMAGE),
                        tags.index(infra_vm._ORCHESTRATOR_FC_IMAGE))
+        image_id.assert_called_once_with(infra_vm._ORCHESTRATOR_IMAGE)
+        self.assertEqual(
+            {"ORCHESTRATOR_BASE_IMAGE": "sha256:" + "a" * 64},
+            build.call_args_list[-1].kwargs["build_args"],
+        )


 class TestStop(unittest.TestCase):