chore(ci): isolate Docker-dependent acceptance tests by parker-snyk · Pull Request #7007 · snyk/cli

parker-snyk · 2026-07-16T18:19:16Z

Measured impact

A successful before-and-after comparison reduced both CircleCI usage and PR validation time:

	Before	After	Savings
CircleCI credits	64,023	60,510	3,513 credits (5.5%)
Workflow duration	53m10s	47m13s	5m57s (11.2%)

Comparison runs:

What changed

The acceptance workflow previously started Remote Docker for every Docker and Alpine shard, creating 36 Remote Docker environments per PR. Only two container tests use the Docker daemon.

This change moves those two tests into one dedicated Remote Docker job. The other 134 acceptance specs keep their existing platform coverage without starting Remote Docker. It also removes the unused Docker package from the Alpine test setup.

Tracking ticket: IDP-6

Validation

make format
make lint
make build
CircleCI pipeline 38482 passed, including the dedicated Docker daemon job

Run Docker daemon coverage in one dedicated Linux acceptance job instead of provisioning Remote Docker for every Docker and Alpine shard. Keep the remaining acceptance matrix free of Docker daemon commands and remove the unused Docker package from Alpine setup.

Install and verify a pinned Docker Compose plugin in the dedicated daemon job, then invoke proxy fixtures through the supported docker compose command. This makes the relocated proxy-authentication tests execute instead of failing because the build image lacks the legacy docker-compose binary.

Copy the proxy setup scripts into the fixture image instead of bind-mounting a path that is unavailable on CircleCI's remote Docker VM. Copy the generated Kerberos credentials back into the test workspace with docker cp so the CLI can still consume them.

Keep proxy-authentication coverage in its existing conditional suite because CircleCI Remote Docker does not provide the two-way networking that fixture requires. Remove the Compose and fixture changes so the dedicated Remote Docker job runs only the container daemon tests targeted by this optimization.

snyk-io · 2026-07-16T18:19:42Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-07-16T18:20:39Z

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!

Generated by 🚫 dangerJS against 21ff559

snyk-pr-review-bot · 2026-07-16T18:24:05Z

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ Recommended focus areas for review Reduced Platform Coverage 🟡 [minor] The Docker-dependent acceptance tests were previously executed across multiple platforms (Windows, Linux Arm64, Alpine). This PR isolates them to a single `linux/amd64` job. While this saves significant CI credits, it removes validation for architecture-specific behaviors (e.g., Docker socket handling or image analysis on Arm64) that the CLI might encounter in production on those platforms. Per `AGENTS.md`, acceptance tests are expected to cover multiple OS/arch combinations. find test/jest/acceptance ts-binary-wrapper/test/acceptance -name '.spec.ts' ! -name '.docker.spec.ts' \ \| circleci tests run \ --command="xargs npx jest --maxWorkers=1 --selectProjects coreCli --reporters=jest-junit --reporters=default --forceExit --" \ --split-by=timings \ --timings-type=file Removed Remote Docker Support 🟡 [minor] The `setup_remote_docker` command was previously active for all `alpine.*` executors. This PR removes that automatic activation, meaning any tests remaining in the Alpine shard that might implicitly rely on Docker environment detection or sidecar services will now fail. This is paired with the removal of the `docker` CLI package in `install-deps-alpine-full`. - when: condition: << parameters.remote_docker >> steps: - setup_remote_docker: docker_layer_caching: false
📚 Repository Context Analyzed This review considered 6 relevant code sections from 5 files (average relevance: 1.00) CONTRIBUTING.md (lines 1-231) package.json (lines 1-235) CLAUDE.md (lines 116-259) src/cli/main.ts (2 segments, lines 1-236) help/cli-commands/container-test.md (lines 1-178)
🤖 Repository instructions applied (from `AGENTS.md`)

robertolopezlopez · 2026-07-17T08:19:29Z

+
+jest.setTimeout(1000 * 300);
+
+describe('snyk container with a local Docker daemon', () => {


This may lead to problems when executing the tests directly with jest (locally)

before

windows safe guard (container.spec.ts:132)

describeIf(!isWindows)('test', () => {

macos safe guard (lines 348, 408)

if (os.platform() === 'darwin') { return; }

after

tests were moved under this line describe('snyk container with a local Docker daemon', () => {

no safeguards for windows nor macos (apparently, please correct me if I am wrong)

Could you please address or elaborate on this (apparent) issue?

Thanks, good job

danskmt · 2026-07-17T10:22:50Z

+
+const execAsync = promisify(exec);
+
+jest.setTimeout(1000 * 300);


should each it have a timeout as well to be set?

yes, maybe more granular will be better

danskmt · 2026-07-17T10:32:04Z

+          requires:
+            - build linux amd64


should these tests consider only Linux?
I wonder if we should consider Windows as well. I see that before they were being ignored on MacOS.

docker tests are currently running just for linux if I am not mistaken

parker-snyk added 4 commits July 16, 2026 12:08

parker-snyk marked this pull request as ready for review July 16, 2026 18:21

parker-snyk requested a review from a team as a code owner July 16, 2026 18:21

robertolopezlopez reviewed Jul 17, 2026

View reviewed changes

danskmt reviewed Jul 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(ci): isolate Docker-dependent acceptance tests - #7007

chore(ci): isolate Docker-dependent acceptance tests#7007
parker-snyk wants to merge 4 commits into
mainfrom
IDP-6-circleci-docker-test-split

parker-snyk commented Jul 16, 2026 •

edited

Loading

Uh oh!

snyk-io Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

snyk-pr-review-bot Bot commented Jul 16, 2026

Uh oh!

robertolopezlopez Jul 17, 2026

Uh oh!

danskmt Jul 17, 2026

Uh oh!

robertolopezlopez Jul 17, 2026

Uh oh!

danskmt Jul 17, 2026 •

edited

Loading

Uh oh!

robertolopezlopez Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		jest.setTimeout(1000 * 300);

		describe('snyk container with a local Docker daemon', () => {


		const execAsync = promisify(exec);

		jest.setTimeout(1000 * 300);

Uh oh!

Conversation

parker-snyk commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Measured impact

What changed

Validation

Uh oh!

snyk-io Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

snyk-pr-review-bot Bot commented Jul 16, 2026

PR Reviewer Guide 🔍

Uh oh!

robertolopezlopez Jul 17, 2026

Choose a reason for hiding this comment

before

after

Uh oh!

danskmt Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

robertolopezlopez Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

danskmt Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robertolopezlopez Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

parker-snyk commented Jul 16, 2026 •

edited

Loading

snyk-io Bot commented Jul 16, 2026 •

edited

Loading

danskmt Jul 17, 2026 •

edited

Loading