{"id":51529601,"url":"https://github.com/coroboros/karate","last_synced_at":"2026-07-09T01:30:39.405Z","repository":{"id":366140732,"uuid":"1275180777","full_name":"coroboros/karate","owner":"coroboros","description":"GitLab mirror of karate — run Karate API and integration tests in CI: REST, GraphQL, WebSocket, mock server.","archived":false,"fork":false,"pushed_at":"2026-06-20T11:59:54.000Z","size":103,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-20T13:27:11.413Z","etag":null,"topics":["apache-2-0","api-testing","ci","container-image","coroboros","devsecops","docker","ghcr","gitlab-ci","graphql","integration-testing","java","karate","mock-server","rest-api","websocket"],"latest_commit_sha":null,"homepage":"https://coroboros.com","language":"Shell","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/coroboros.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-20T11:03:34.000Z","updated_at":"2026-06-20T11:59:57.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/coroboros/karate","commit_stats":null,"previous_names":["coroboros/karate"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/coroboros/karate","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coroboros%2Fkarate","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coroboros%2Fkarate/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coroboros%2Fkarate/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coroboros%2Fkarate/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/coroboros","download_url":"https://codeload.github.com/coroboros/karate/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coroboros%2Fkarate/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35283905,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-08T02:00:06.796Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apache-2-0","api-testing","ci","container-image","coroboros","devsecops","docker","ghcr","gitlab-ci","graphql","integration-testing","java","karate","mock-server","rest-api","websocket"],"created_at":"2026-07-09T01:30:38.522Z","updated_at":"2026-07-09T01:30:39.394Z","avatar_url":"https://github.com/coroboros.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n\u003cimg src=\"assets/logo.png\" width=\"288\" height=\"288\" alt=\"karate\"/\u003e\n\n\u003c!-- omit in toc --\u003e\n# karate\n\n**Run Karate API and integration tests in CI — REST, GraphQL, WebSocket, mock server.**\n\nAlpine-based image bundling the [Karate](https://github.com/karatelabs/karate) fat jar on top of `eclipse-temurin:21-jre-alpine`, with `bash` and `ca-certificates` for shell wrappers and HTTPS test targets. Ships a CI/CD component — one include runs a `.feature` suite and publishes the HTML report as a job artifact.\n\n[![latest](https://img.shields.io/gitlab/v/release/coroboros%2Finfrastructure%2Fkarate?style=flat-square\u0026label=latest\u0026color=000000)](https://gitlab.com/coroboros/infrastructure/karate/-/releases)\n[![pipeline](https://img.shields.io/gitlab/pipeline-status/coroboros%2Finfrastructure%2Fkarate?branch=main\u0026style=flat-square\u0026label=pipeline\u0026color=000000)](https://gitlab.com/coroboros/infrastructure/karate/-/pipelines)\n[![ghcr.io](https://img.shields.io/badge/ghcr.io-karate-000000?style=flat-square\u0026logo=github)](https://github.com/orgs/coroboros/packages/container/package/karate)\n[![Docker Hub](https://img.shields.io/badge/docker_hub-karate-000000?style=flat-square\u0026logo=docker\u0026logoColor=white)](https://hub.docker.com/r/coroboros/karate)\n[![license](https://img.shields.io/badge/license-Apache_2.0-000000?style=flat-square)](LICENSE.md)\n[![stars](https://img.shields.io/gitlab/stars/coroboros%2Finfrastructure%2Fkarate?style=flat-square\u0026label=stars\u0026color=000000)](https://gitlab.com/coroboros/infrastructure/karate)\n[![skills](https://img.shields.io/badge/skills-000000?style=flat-square\u0026logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxNiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAwIDE2IDE2IiBmaWxsPSJ3aGl0ZSI+PHBvbHlnb24gcG9pbnRzPSI4LDAgMTAsNiAxNiw4IDEwLDEwIDgsMTYgNiwxMCAwLDggNiw2Ii8+PC9zdmc+)](https://github.com/coroboros/agent-skills)\n[![coroboros.com](https://img.shields.io/badge/coroboros.com-000000?style=flat-square\u0026logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9IndoaXRlIiBzdHJva2Utd2lkdGg9IjIiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCI+PGNpcmNsZSBjeD0iMTIiIGN5PSIxMiIgcj0iMTAiLz48cGF0aCBkPSJNMiAxMmgyME0xMiAyYTE1LjMgMTUuMyAwIDAgMSA0IDEwIDE1LjMgMTUuMyAwIDAgMS00IDEwIDE1LjMgMTUuMyAwIDAgMS00LTEwIDE1LjMgMTUuMyAwIDAgMSA0LTEweiIvPjwvc3ZnPg==)](https://coroboros.com)\n\n\u003c/div\u003e\n\n\u003c!-- omit in toc --\u003e\n## Contents\n\n- [Requirements](#requirements)\n- [Image](#image)\n- [Tags](#tags)\n- [Commands](#commands)\n- [Run](#run)\n- [Reports](#reports)\n- [Agents](#agents)\n- [Packages](#packages)\n- [Provenance](#provenance)\n- [Compared to alternatives](#compared-to-alternatives)\n- [Security](#security)\n- [Contributing](#contributing)\n- [License](#license)\n\n## Requirements\n\nDocker, BuildKit, or any OCI runtime able to pull from the GitHub Container Registry (or the Docker Hub mirror).\n\n## Image\n\n`ghcr.io/coroboros/karate:{tag}` — mirrored to `docker.io/coroboros/karate:{tag}`, and in the GitLab Container Registry at `registry.gitlab.com/coroboros/infrastructure/karate:{tag}`.\n\n- **Architectures**: `linux/amd64`, `linux/arm64`\n- **Working directory**: `/karate`\n- **Entrypoint**: `karate`\n- **Default command**: `/karate/features`\n- **User**: non-root `karate` (uid 10000)\n- **Volumes**: `/karate/features` (mount feature files), `/karate/target` (test output)\n\n## Tags\n\n| Tag | Karate | JRE base | Architectures | Size | Source | Mutability |\n| --- | --- | --- | --- | --- | --- | --- |\n| `2.0.9-temurin21` | [`2.0.9`](images/2.0.9-temurin21/image.env) | [`eclipse-temurin:21-jre-alpine`](images/2.0.9-temurin21/image.env) | `amd64`, `arm64` | 99.7 MB (amd64), 99.4 MB (arm64) | current matrix row | rolling |\n| `\u003csha\u003e-2.0.9-temurin21` | varies by build | varies by build | varies by build | varies by build | every `2.0.9-temurin21` build | immutable |\n\nSizes are compressed layer sums from the GitLab Container Registry. The image tag selects the Karate runner and Java runtime; the repo SemVer tag versions the GitLab CI/CD component. Pin a digest for reproducible builds; see [Provenance](#provenance).\n\n## Commands\n\n`karate [options] [feature_path]`\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003ccode\u003efeature_path\u003c/code\u003e\u003c/summary\u003e\n\n\u003cbr\u003e\n\nOne or more `.feature` files or directories. Defaults to `/karate/features` (the image's exposed volume).\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003ccode\u003eoptions\u003c/code\u003e\u003c/summary\u003e\n\n\u003cbr\u003e\n\nForwarded to the Karate runner. Full reference: [Karate CLI options](https://github.com/karatelabs/karate/wiki/Karate-Options). Most useful flags:\n\n| Flag | Purpose |\n| --- | --- |\n| `-h` | Print help and exit. |\n| `-t @tag` | Run only scenarios tagged `@tag`. Combinable: `-t @smoke,~@wip`. |\n| `-T \u003cn\u003e` | Run `\u003cn\u003e` features in parallel. |\n| `-o \u003cdir\u003e` | Override the output directory (default `/karate/target`). |\n| `-e \u003cenv\u003e` | Set `karate.env` (per-environment config). |\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003ccode\u003eEnvironment variables\u003c/code\u003e\u003c/summary\u003e\n\n\u003cbr\u003e\n\n| Variable | Default | Purpose |\n| --- | --- | --- |\n| `LANG` | `C.UTF-8` | Locale, set in the image for consistent JVM behaviour. |\n| `JAVA_TOOL_OPTIONS` | unset | Standard JVM tuning hook — heap, GC, system properties (`-Dkarate.env=...`). |\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003ccode\u003eExamples\u003c/code\u003e\u003c/summary\u003e\n\n\u003cbr\u003e\n\n```shell\nkarate /karate/features\n```\n\n```shell\nkarate -T 4 -t @smoke /karate/features/api\n```\n\n\u003c/details\u003e\n\n## Run\n\n\u003cdetails\u003e\n\u003csummary\u003eGitLab CI\u003c/summary\u003e\n\n\u003cbr\u003e\n\n```yaml\napi-tests:\n  image:\n    name: registry.gitlab.com/coroboros/infrastructure/karate:\u003ctag\u003e\n    entrypoint: [\"\"]\n  stage: test\n  script:\n    - karate features\n  artifacts:\n    when: always\n    paths:\n      - target/\n```\n\n```yaml\nparallel-tests:\n  image:\n    name: registry.gitlab.com/coroboros/infrastructure/karate:\u003ctag\u003e\n    entrypoint: [\"\"]\n  stage: test\n  script:\n    - karate -T 4 -t @smoke features\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eCI/CD component\u003c/summary\u003e\n\n\u003cbr\u003e\n\nOne include runs the suite and publishes the HTML report as a job artifact. A test failure fails the job; set `allow_failure: true` to keep it advisory.\n\n```yaml\ninclude:\n  - component: gitlab.com/coroboros/infrastructure/karate/karate@\u003cversion\u003e\n    inputs:\n      feature_path: features\n      parallel: 4\n      tags: \"@smoke,~@wip\"\n```\n\nThe final `/karate` segment is the component name from `templates/karate.yml`; GitLab component refs are `\u003cfqdn\u003e/\u003cproject-path\u003e/\u003ccomponent-name\u003e@\u003cversion\u003e`.\n\nInputs: `job_name`, `stage`, `feature_path`, `parallel`, `tags`, `env`, `output_dir`, `options`, `java_tool_options`, `allow_failure`, `image` — see [`templates/karate.yml`](templates/karate.yml). The component version is this repo's SemVer, independent of the image tag.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eDocker\u003c/summary\u003e\n\n\u003cbr\u003e\n\nMount the features directory and run:\n\n```shell\ndocker run --rm \\\n  -v \"$PWD/features:/karate/features\" \\\n  -v \"$PWD/target:/karate/target\" \\\n  registry.gitlab.com/coroboros/infrastructure/karate:\u003ctag\u003e\n```\n\n```shell\ndocker run --rm \\\n  -v \"$PWD/features:/karate/features\" \\\n  -v \"$PWD/target:/karate/target\" \\\n  registry.gitlab.com/coroboros/infrastructure/karate:\u003ctag\u003e \\\n  -T 4 -t @smoke\n```\n\n\u003c/details\u003e\n\n## Reports\n\nKarate writes an HTML report (`karate-summary.html`, per-feature pages, a timeline) to the output directory (`-o`, default `target`). The [CI/CD component](#run) collects it as a job artifact; open `karate-summary.html` for pass/fail per scenario. A failed scenario exits non-zero, so the job fails regardless.\n\n## Agents\n\nkarate ships an agent skill — its own write-and-run guide for Karate feature tests — for coding agents. Install it into an agent:\n\n```sh\nnpx skills add coroboros/karate\n```\n\nOr read it without installing: [`skills/karate/SKILL.md`](skills/karate/SKILL.md).\n\n## Packages\n\nSame across all Karate tags.\n\n| Package | Purpose |\n|---|---|\n| `eclipse-temurin` (JRE) | Java runtime |\n| `karate` | Karate fat jar at `/karate/karate.jar` + `karate` wrapper at `/bin/karate` |\n| `bash` | Shell |\n| `ca-certificates` | TLS certificate bundle for Karate HTTPS test requests |\n\nImage rows are declared in [`images/`](images). Dockerfile defaults stay synced for local builds. Renovate maintains the current Karate row and its JAR checksum in one merge request, and refreshes the current JRE base digest.\n\n## Provenance\n\nEvery published image, via the shared [`coroboros/ci`](https://gitlab.com/coroboros/ci) `container-images` template, is:\n\n- **multi-arch** — BuildKit, `linux/amd64,linux/arm64`;\n- **gated** — source secrets via `gitleaks`, image CVEs via Trivy on the published `:sha`, and the offline Karate smoke feature before tag promotion;\n- **signed** — cosign keyless on the immutable digest, with a **CycloneDX SBOM** attestation.\n\nOn version tags, the promoted digest is published to the GitLab Registry, GitHub Container Registry, and Docker Hub. Each registry-local digest is signed and attested after copy.\n\n### Pinning\n\n`2.0.9-temurin21` is a **rolling image tag for that Karate/JRE pair**. Base-image CVE fixes can move it; exact reproducibility uses the signed digest. The CI matrix is the support list: a new Karate version gets a new `\u003ckarate-version\u003e-\u003cruntime\u003e` row, and a different Java runtime gets its own row only after compatibility is verified.\n\nFor reproducible, tamper-evident builds, pin the **manifest-list digest** (multi-arch) through the `image` input and let Renovate keep it current:\n\n```yaml\ninclude:\n  - component: gitlab.com/coroboros/infrastructure/karate/karate@\u003cversion\u003e\n    inputs:\n      image: registry.gitlab.com/coroboros/infrastructure/karate:\u003ctag\u003e@sha256:\u003cmanifest-list-digest\u003e\n```\n\nA cosign signature is bound to the digest, not the tag, so verify the pinned digest:\n\n```sh\ncosign verify \\\n  --certificate-identity-regexp 'https://gitlab.com/coroboros/infrastructure/karate//.*' \\\n  --certificate-oidc-issuer https://gitlab.com \\\n  ghcr.io/coroboros/karate@sha256:\u003cmanifest-list-digest\u003e\n```\n\n## Compared to alternatives\n\n### vs other API testing frameworks\n\n| Capability | `cucumber-jvm` | `rest-assured` | `postman` / `newman` | `playwright` (API) | **`karate`** |\n| --- | :---: | :---: | :---: | :---: | :---: |\n| BDD-style feature syntax | yes | no | no | no | yes |\n| HTTP / REST testing | via libs | yes | yes | yes | yes |\n| GraphQL testing | via libs | as raw HTTP | yes (UI / scripts) | as raw HTTP | yes |\n| Built-in match assertion (fuzzy / schema) | no | no | no | no | yes |\n| Parallel execution | runner-specific | runner-specific | yes | yes | yes (`-T`) |\n| Mock server included | no | no | yes (UI) | no | yes |\n| Single-binary execution | no | no | yes | no | yes (fat jar) |\n| No glue code (Java / JS) | no | no | yes | no | yes |\n\nDifference: karate combines BDD-style feature files with built-in HTTP / GraphQL / WebSocket clients, schema-aware `match` assertions, and a mock server — from a single fat jar with no glue code.\n\n### vs other Karate Docker images\n\n| Image | Base | Size | Last update | Focus |\n| --- | --- | --- | --- | --- |\n| `karatelabs/karate-chrome` (official) | Ubuntu + Chrome + Xvfb + VNC | ~800 MB | ~6 months ago | Browser automation |\n| `tgintegrationtests/karate` (community) | unspecified | — | ~7 months ago | General-purpose |\n| `remarkableas/karate` (community) | unspecified | — | ~5 years ago | Stale |\n| `ibmurai/karate` (community) | unspecified | — | ~7 years ago | Stale |\n| **`coroboros/infrastructure/karate`** | `eclipse-temurin:21-jre-alpine` | 99.7 MB (amd64), 99.4 MB (arm64) | rolling | API / integration testing |\n\nDifference: the official `karatelabs/karate-chrome` bundles Chrome + Xvfb + VNC for browser automation — ~800 MB, overkill for pure API testing. Community images are stale (5–7 years). This image strips back to JRE 21 + Karate fat jar on Alpine: about 8× smaller, current, non-root, with `features` / `target` exposed as volumes.\n\n## Security\n\nReport a vulnerability privately via the [security policy](SECURITY.md) — **ob@coroboros.com**, never a public issue.\n\n## Contributing\n\nBug reports and merge requests welcome.\n\n- Open an issue before submitting non-trivial merge requests.\n- Commits follow [Conventional Commits](https://www.conventionalcommits.org/).\n- Sign off each commit (DCO): `git commit -s`.\n- Target the `main` branch.\n\n## License\n\n[Apache 2.0](LICENSE.md)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoroboros%2Fkarate","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcoroboros%2Fkarate","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoroboros%2Fkarate/lists"}