add proxy integration tests

internal/infra/proxy.go

@@ -45,7 +45,6 @@ func NewProxy(ctx context.Context, cli *client.Client, params *RunParams, nets *
 	}
 
 	hostCfg := &container.HostConfig{
-		AutoRemove: true,
 		ExtraHosts: []string{
 			"host.docker.internal:host-gateway",
 		},
@@ -169,13 +168,26 @@ func (p *Proxy) TailLogs(ctx context.Context, cli *client.Client) {
 	_, _ = stdcopy.StdCopy(w, w, out)
 }
 
-func (p *Proxy) Close() error {
+func (p *Proxy) Close() (err error) {
+	defer func() {
+		removeErr := p.cli.ContainerRemove(context.Background(), p.containerID, types.ContainerRemoveOptions{Force: true})
+		if removeErr != nil {
+			err = fmt.Errorf("failed to remove proxy container: %w", removeErr)
+		}
+	}()
+
+	// Check the error code if the container has already exited, so we can pass it along to the caller. If the proxy
+	//crashes we want the CLI to error out. Unlike the Updater it should never stop on its own.
+	containerInfo, inspectErr := p.cli.ContainerInspect(context.Background(), p.containerID)
+	if inspectErr != nil {
+		return fmt.Errorf("failed to inspect proxy container: %w", inspectErr)
+	}
+	if containerInfo.State.ExitCode != 0 {
+		return fmt.Errorf("proxy container exited with non-zero exit code: %d", containerInfo.State.ExitCode)
+	}
+
 	timeout := 5
 	_ = p.cli.ContainerStop(context.Background(), p.containerID, container.StopOptions{Timeout: &timeout})
 
-	err := p.cli.ContainerRemove(context.Background(), p.containerID, types.ContainerRemoveOptions{Force: true})
-	if err != nil {
-		return fmt.Errorf("failed to remove proxy container: %w", err)
-	}
-	return nil
+	return err
 }

internal/infra/run.go

@@ -15,14 +15,13 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/dependabot/cli/internal/model"
+	"github.com/dependabot/cli/internal/server"
+	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/hexops/gotextdiff"
 	"github.com/hexops/gotextdiff/myers"
 	"github.com/hexops/gotextdiff/span"
-
-	"github.com/dependabot/cli/internal/model"
-	"github.com/dependabot/cli/internal/server"
-	"github.com/docker/docker/api/types"
 	"github.com/moby/moby/api/types/registry"
 	"github.com/moby/moby/client"
 	"gopkg.in/yaml.v3"
@@ -330,8 +329,9 @@ func generateIgnoreConditions(params *RunParams, actual *model.Scenario) error {
 	return nil
 }
 
-func runContainers(ctx context.Context, params RunParams) error {
-	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
+func runContainers(ctx context.Context, params RunParams) (err error) {
+	var cli *client.Client
+	cli, err = client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
 	if err != nil {
 		return fmt.Errorf("failed to create Docker client: %w", err)
 	}
@@ -365,7 +365,11 @@ func runContainers(ctx context.Context, params RunParams) error {
 	if err != nil {
 		return err
 	}
-	defer prox.Close()
+	defer func() {
+		if proxyErr := prox.Close(); proxyErr != nil {
+			err = proxyErr
+		}
+	}()
 
 	// proxy logs interfere with debugging output
 	if !params.Debug {

testdata/scripts/proxy.txt

@@ -0,0 +1,58 @@
+# Tests related to running the Proxy
+
+exec docker build -qt proxy-updater .
+exec docker build -qt dummy-proxy -f Dockerfile.proxy .
+
+dependabot update go_modules dependabot/cli --updater-image proxy-updater --proxy-image dummy-proxy
+stderr 'proxy \| Proxy is running'
+stderr 'updater \| Updater is running'
+! stderr 'proxy \| custom-ca-cert\.crt'
+
+dependabot update go_modules dependabot/cli --proxy-cert my-cert --updater-image proxy-updater --proxy-image dummy-proxy
+stderr 'proxy \| custom-ca-cert\.crt'
+stderr 'proxy \| I am a certificate'
+
+# Test that the CLI exits with non-zero if the proxy does too.
+! dependabot update go_modules dependabot/cli --proxy-cert crash --updater-image proxy-updater --proxy-image dummy-proxy --proxy-username user --proxy-password pass
+
+exec docker rmi -f proxy-updater dummy-proxy
+
+-- crash --
+crash
+
+-- my-cert --
+I am a certificate
+
+-- Dockerfile.proxy --
+FROM ubuntu:22.04
+
+COPY --chmod=755 update-ca-certificates /usr/bin/update-ca-certificates
+COPY --chmod=755 update-job-proxy /update-job-proxy
+
+-- update-job-proxy --
+#!/usr/bin/env bash
+
+echo "Proxy is running"
+echo "$(</config.json)"
+
+-- Dockerfile --
+FROM ubuntu:22.04
+
+RUN useradd dependabot
+
+COPY --chown=dependabot --chmod=755 update-ca-certificates /usr/bin/update-ca-certificates
+COPY --chown=dependabot --chmod=755 run bin/run
+
+-- update-ca-certificates --
+#!/usr/bin/env bash
+
+ls /usr/local/share/ca-certificates || true
+cat /usr/local/share/ca-certificates/custom-ca-cert.crt || true
+
+# signal to cause the proxy to exit with a non-zero code
+grep crash /usr/local/share/ca-certificates/custom-ca-cert.crt && exit 1 || true
+
+-- run --
+#!/usr/bin/env bash
+
+echo "Updater is running"