Merge pull request #3265 from LeSuisse/sign-container-image-cosign

Sign container image using Cosign in keyless mode

.github/workflows/publish-docker-images.yml

@@ -16,6 +16,8 @@ on:
 jobs:
   docker:
     runs-on: docker
+    permissions:
+      id-token: write # This is needed to use Cosign in keyless mode
     steps:
       - uses: actions/checkout@v3
 
@@ -62,6 +64,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # tag=v3.8.2
+
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -85,6 +90,7 @@ jobs:
 
       - name: Build and push
         uses: docker/build-push-action@v6
+        id: build-and-push
         with:
           push: true
           platforms: linux/amd64,linux/arm64
@@ -94,6 +100,17 @@ jobs:
             COMMIT_DATE=${{ steps.build-metadata.outputs.date }}
             GIT_TAG=${{ github.ref_name }}
 
+      - name: Sign the images with GitHub OIDC Token
+        env:
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          images=""
+          for tag in ${TAGS}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes ${images}
+
       # /!\ Don't touch this without checking with Cloud team
       - name: Send CI information to Cloud team
         # Do not send if nightly build (i.e. 'schedule' or 'workflow_dispatch' event)

crates/meilisearch/tests/stats/mod.rs

@@ -6,8 +6,8 @@ use crate::common::Server;
 use crate::json;
 
 #[actix_rt::test]
-async fn get_settings_unexisting_index() {
-    let server = Server::new().await;
+async fn get_version() {
+    let server = Server::new_shared();
     let (response, code) = server.version().await;
     assert_eq!(code, 200);
     let version = response.as_object().unwrap();
@@ -18,7 +18,7 @@ async fn get_settings_unexisting_index() {
 
 #[actix_rt::test]
 async fn test_healthyness() {
-    let server = Server::new().await;
+    let server = Server::new_shared();
 
     let (response, status_code) = server.service.get("/health").await;
     assert_eq!(status_code, 200);
@@ -55,7 +55,7 @@ async fn stats() {
     ]);
 
     let (response, code) = index.add_documents(documents, None).await;
-    assert_eq!(code, 202, "{}", response);
+    assert_eq!(code, 202, "{response}");
     assert_eq!(response["taskUid"], 1);
 
     index.wait_task(response.uid()).await.succeeded();
@@ -78,8 +78,8 @@ async fn stats() {
 
 #[actix_rt::test]
 async fn add_remove_embeddings() {
-    let server = Server::new().await;
-    let index = server.index("doggo");
+    let server = Server::new_shared();
+    let index = server.unique_index();
 
     let (response, code) = index
         .update_settings(json!({
@@ -216,8 +216,8 @@ async fn add_remove_embeddings() {
 
 #[actix_rt::test]
 async fn add_remove_embedded_documents() {
-    let server = Server::new().await;
-    let index = server.index("doggo");
+    let server = Server::new_shared();
+    let index = server.unique_index();
 
     let (response, code) = index
         .update_settings(json!({
@@ -293,8 +293,8 @@ async fn add_remove_embedded_documents() {
 
 #[actix_rt::test]
 async fn update_embedder_settings() {
-    let server = Server::new().await;
-    let index = server.index("doggo");
+    let server = Server::new_shared();
+    let index = server.unique_index();
 
     // 2 embedded documents for 3 embeddings in total
     // but no embedders are added in the settings yet so we expect 0 embedded documents for 0 embeddings in total