Add initial GitHub Actions tests of behavior/output

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+  schedule:
+    - cron: 0 0 * * 0
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: 'bash -Eeuo pipefail -x {0}'
+
+jobs:
+  test:
+    name: Smoke Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Bashbrew
+        run: |
+          # not doing "uses: docker-library/bashbrew@xxx" because it'll build which is slow and we don't need more than just bashbrew here
+          mkdir .bin
+          wget -O .bin/bashbrew 'https://github.com/docker-library/bashbrew/releases/download/v0.1.9/bashbrew-amd64'
+          echo '8cdd7adc707b972040577006f7a05b8e9d4dd362be5069f862fd1885f2eb107a *.bin/bashbrew' | sha256sum --strict --check -
+          chmod +x .bin/bashbrew
+          .bin/bashbrew --version
+          echo "$PWD/.bin" >> "$GITHUB_PATH"
+      - run: .test/test.sh
+      - run: git diff --exit-code

.test/.external-pins/file.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+# given an image (name:tag), return the appropriate filename
+
+dir="$(dirname "$BASH_SOURCE")"
+
+for img; do
+	if [[ "$img" != *:* ]]; then
+		echo >&2 "error: '$img' does not contain ':' -- this violates our assumptions! (did you mean '$img:latest' ?)"
+		exit 1
+	fi
+
+	imgFile="$dir/${img/:/___}" # see ".external-pins/list.sh"
+	echo "$imgFile"
+done

.test/.external-pins/library/alpine___3.16

@@ -0,0 +1 @@
+sha256:e4cdb7d47b06ba0a062ad2a97a7d154967c8f83934594d9f2bd3efa89292996b

.test/.external-pins/library/alpine___3.18

@@ -0,0 +1 @@
+sha256:34871e7290500828b39e22294660bee86d966bc0017544e848dd9a255cdf59e0

.test/.external-pins/list.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+dir="$(dirname "$BASH_SOURCE")"
+
+find "$dir" -mindepth 2 -type f -printf '%P\n' | sed -e 's/___/:/' | sort
+
+# assumptions which make the "___" -> ":" conversion ~safe (examples referencing "example.com/foo/bar:baz"):
+#
+#   1. we *always* specify a tag ("baz")
+#   2. the domain ("example.com") cannot contain underscores
+#   3. we do not pin to any registry with a non-443 port ("example.com:8443")
+#   4. the repository ("foo/bar") can only contain singular or double underscores (never triple underscore), and only between alphanumerics (thus never right up next to ":")
+#   5. we do *not* use the "g" regex modifier in our sed, which means only the first instance of triple underscore is replaced (in pure Bash, that's "${img/:/___}" or "${img/___/:}" depending on the conversion direction)
+#
+# see https://github.com/distribution/distribution/blob/411d6bcfd2580d7ebe6e346359fa16aceec109d5/reference/regexp.go
+# (see also https://github.com/docker-library/perl-bashbrew/blob/6685582f7889ef4806f0544b93f10640c7608b1a/lib/Bashbrew/RemoteImageRef.pm#L9-L26 for a condensed version)
+#
+# see https://github.com/docker-library/official-images/issues/13608 for why we can't just use ":" as-is (even though Linux, macOS, and even Windows via MSYS / WSL2 don't have any issues with it)

.test/.external-pins/mcr.microsoft.com/windows/servercore___1809

@@ -0,0 +1 @@
+sha256:4fe58f25a157ea749c7b770acebfdbd70c3cb2088c446943e90fe89ea059558b

.test/.external-pins/mcr.microsoft.com/windows/servercore___ltsc2022

@@ -0,0 +1 @@
+sha256:308ef3f8ee3e9c9a1bdec460009c1e6394b329db13eb3149461f8841be5b538a