test: replace live r8.im registry with local test registry in integration tests (#2816)

Use registry-seed with crane.Copy to seed base images into a local test
registry instead of hitting the live r8.im registry, which is flaky in CI.

- Add registry-seed harness command supporting both local and external sources
- Convert build_base_image_sha, build_cog_version_match, build_python313_base_image
  to seed python:3.12/3.13-slim from Docker Hub via crane
- Convert torch_cuda_baseimage to use cog debug with a dummy seeded image
- Fix name.Insecure missing from ParseReference in build.go (consistent with
  pkg/registry/)

Author: michaeldwan

integration-tests/harness/harness.go

@@ -20,6 +20,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/google/go-containerregistry/pkg/crane"
 	"github.com/rogpeppe/go-internal/testscript"
 
 	"github.com/replicate/cog/pkg/registry"
@@ -247,6 +248,7 @@ func (h *Harness) Commands() map[string]func(ts *testscript.TestScript, neg bool
 		// Registry and OCI bundle testing commands
 		NewCommand("registry-start", h.cmdRegistryStart),
 		NewCommand("registry-inspect", h.cmdRegistryInspect),
+		NewCommand("registry-seed", h.cmdRegistrySeed),
 		NewCommand("docker-push", h.cmdDockerPush),
 		NewCommand("mock-weights", h.cmdMockWeights),
 
@@ -886,6 +888,61 @@ func (h *Harness) stopRegistryByWorkDir(workDir string) {
 	}
 }
 
+// cmdRegistrySeed copies an image into the test registry under a new repository:tag.
+// The source can be a local reference (relative to $TEST_REGISTRY) or an absolute
+// reference to an external registry (e.g., docker.io/library/python:3.12-slim).
+// The destination is always relative to $TEST_REGISTRY.
+//
+// Usage: registry-seed <source> <dest-repo:tag>
+// Examples:
+//
+//	registry-seed alpine:latest cog-base:cuda11.8-python3.10-torch2.0.1
+//	registry-seed docker.io/library/python:3.12-slim cog-base:python3.12
+func (h *Harness) cmdRegistrySeed(ts *testscript.TestScript, neg bool, args []string) {
+	if neg {
+		ts.Fatalf("registry-seed: does not support negation")
+	}
+	if len(args) < 2 {
+		ts.Fatalf("registry-seed: usage: registry-seed <source> <dest-repo:tag>")
+	}
+
+	src := os.Expand(args[0], ts.Getenv)
+	dst := os.Expand(args[1], ts.Getenv)
+
+	testRegistry := ts.Getenv("TEST_REGISTRY")
+	if testRegistry == "" {
+		ts.Fatalf("registry-seed: TEST_REGISTRY not set (call registry-start first)")
+	}
+
+	// If the source looks like an absolute reference (contains a registry host
+	// with a dot, e.g. "docker.io/library/python:3.12-slim"), use it as-is.
+	// Otherwise treat it as relative to the test registry.
+	srcRef := src
+	if !isAbsoluteImageRef(src) {
+		srcRef = testRegistry + "/" + src
+	}
+	dstRef := testRegistry + "/" + dst
+
+	if err := crane.Copy(srcRef, dstRef, crane.Insecure); err != nil {
+		ts.Fatalf("registry-seed: failed to copy %s to %s: %v", srcRef, dstRef, err)
+	}
+
+	ts.Logf("registry-seed: copied %s to %s", srcRef, dstRef)
+}
+
+// isAbsoluteImageRef returns true if ref looks like it contains an explicit
+// registry host (e.g. "docker.io/library/python:3.12-slim" or
+// "ghcr.io/foo/bar:latest"). It checks whether the part before the first
+// slash contains a dot or a colon (port), which distinguishes a registry
+// host from a simple repository name like "alpine:latest".
+func isAbsoluteImageRef(ref string) bool {
+	host, _, ok := strings.Cut(ref, "/")
+	if !ok {
+		return false
+	}
+	return strings.Contains(host, ".") || strings.Contains(host, ":")
+}
+
 // cmdRegistryInspect inspects a registry manifest and outputs JSON.
 // Usage: registry-inspect <image-ref>
 // Outputs the manifest result as JSON to stdout.

integration-tests/tests/build_base_image_sha.txtar

@@ -1,7 +1,14 @@
 # Test that base image SHA is recorded in labels with --use-cog-base-image
 # Source: test_build.py::test_build_base_image_sha
+#
+# Uses a local test registry to avoid depending on the live r8.im registry.
 
-# Build with --use-cog-base-image flag
+# Start local registry and seed a cog-base image from Docker Hub's python:3.12-slim
+registry-start
+registry-seed docker.io/library/python:3.12-slim cog-base:python3.12
+
+# Build with --use-cog-base-image flag against the local registry
+env COG_REGISTRY_HOST=$TEST_REGISTRY
 cog build -t $TEST_IMAGE --use-cog-base-image
 
 # Verify the base image layer label matches one of the actual layers

integration-tests/tests/build_cog_version_match.txtar

@@ -7,8 +7,15 @@
 #
 # This test verifies that when building with --use-cog-base-image,
 # the installed Python cog package has a valid version number.
+#
+# Uses a local test registry to avoid depending on the live r8.im registry.
+
+# Start local registry and seed a cog-base image from Docker Hub's python:3.12-slim
+registry-start
+registry-seed docker.io/library/python:3.12-slim cog-base:python3.12
 
-# Build using --use-cog-base-image
+# Build using --use-cog-base-image against local registry
+env COG_REGISTRY_HOST=$TEST_REGISTRY
 cog build -t $TEST_IMAGE --use-cog-base-image=true
 
 # Compare the embedded version label with the Python package version inside the image

integration-tests/tests/build_python313_base_image.txtar

@@ -1,7 +1,14 @@
 # Test Python 3.13 works with --use-cog-base-image
 # Source: test_build.py::test_python_313_base_images
+#
+# Uses a local test registry to avoid depending on the live r8.im registry.
 
-# Build using Python 3.13 with --use-cog-base-image
+# Start local registry and seed a cog-base image from Docker Hub's python:3.13-slim
+registry-start
+registry-seed docker.io/library/python:3.13-slim cog-base:python3.13
+
+# Build using Python 3.13 with --use-cog-base-image against local registry
+env COG_REGISTRY_HOST=$TEST_REGISTRY
 cog build -t $TEST_IMAGE --use-cog-base-image
 
 # Verify build succeeded by running a prediction

integration-tests/tests/torch_cuda_baseimage.txtar

@@ -1,7 +1,17 @@
-[short] skip 'slow test - run without -short flag'
+# Test that cog correctly resolves a cog-base image for Torch 2.0.1+cu118
+# and generates the expected Dockerfile with --use-cog-base-image.
+#
+# Uses a local test registry seeded with a dummy image to avoid depending
+# on the live r8.im registry, which can be flaky in CI.
 
-# Test Torch 2.0.1+cu118 with --use-cog-base-image flag
-cog build -t $TEST_IMAGE --use-cog-base-image
+# Start local registry and seed a dummy cog-base image
+registry-start
+registry-seed alpine:latest cog-base:cuda11.8-python3.10-torch2.0.1
+
+# Generate Dockerfile using the local registry as the cog-base source
+env COG_REGISTRY_HOST=$TEST_REGISTRY
+cog debug --use-cog-base-image
+stdout 'FROM.*cog-base:cuda11.8-python3.10-torch2.0.1'
 
 -- cog.yaml --
 build:

pkg/image/build.go

@@ -300,7 +300,9 @@ func Build(
 	if cogBaseImageName != "" {
 		labels[global.LabelNamespace+"cog-base-image-name"] = cogBaseImageName
 
-		ref, err := name.ParseReference(cogBaseImageName)
+		// name.Insecure allows HTTP fallback for local/test registries,
+		// consistent with ParseReference calls in pkg/registry/.
+		ref, err := name.ParseReference(cogBaseImageName, name.Insecure)
 		if err != nil {
 			return "", fmt.Errorf("Failed to parse cog base image reference: %w", err)
 		}