feat: use Alpine AOT images, static SQLite and Podman host metrics [CI]

ci/release-linux.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Build a framework-dependent Backend OCI image for the requested arch; publishing is optional.
+# Build a musl NativeAOT Backend OCI image with statically linked SQLite; publishing is optional.
 set -euo pipefail
 
 arch="${1:?usage: release-linux.sh <amd64|arm64>}"
@@ -28,7 +28,8 @@ if [[ "$image_publish" == true ]]; then
   }
 fi
 case "$arch" in
-  amd64|arm64) ;;
+  amd64) rid=linux-musl-x64 ;;
+  arm64) rid=linux-musl-arm64 ;;
   *) echo "unsupported architecture: $arch" >&2; exit 2 ;;
 esac
 
@@ -51,12 +52,13 @@ export MONITOR_COMMIT="${MONITOR_COMMIT:-${CI_COMMIT_SHA:0:10}}"
 export MONITOR_BUILT_AT="${MONITOR_BUILT_AT:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}"
 
 (cd "$root/backend" && dotnet publish src/Monitor.Backend \
-  -m:3 -c Release --no-self-contained \
+  -m:3 -c Release -r "$rid" --self-contained true \
   -p:DebugType=none -p:DebugSymbols=false \
-  -p:UseAppHost=false -p:OpenApiGenerateDocuments=false \
+  -p:PublishAot=true -p:UseAotAnywhere=true -p:SqliteStaticLink=true -p:OpenApiGenerateDocuments=false \
   --artifacts-path "$build_root" -o "$output")
-find "$output" -type f -name '*.pdb' -delete
-cp -a "$output/." "$container_context/app/"
+[[ -x "$output/monitor-backend" ]] || { echo "NativeAOT Backend executable is missing" >&2; exit 1; }
+[[ "$(wc -c < "$output/monitor-backend")" -gt 2000000 ]] || { echo "Backend output is an apphost, not a NativeAOT executable" >&2; exit 1; }
+install -m 0755 "$output/monitor-backend" "$container_context/app/monitor-backend"
 : > "$container_context/data/.keep"
 
 # Woodpecker's local backend isolates HOME per workflow. Keep Buildah's image

ci/release-node-images.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Publish glibc OCI images for the Linux Agent and Probe on amd64 and arm64.
+# Publish musl OCI images for the Linux Agent and Probe on amd64 and arm64.
 set -euo pipefail
 
 tag="${CI_COMMIT_TAG:-}"
@@ -113,7 +113,7 @@ publish_index() {
 }
 
 for component in agent probe; do
-  build_arch_image "$component" amd64 amd64
-  build_arch_image "$component" arm64 arm64
+  build_arch_image "$component" amd64 musl-amd64
+  build_arch_image "$component" arm64 musl-arm64
   publish_index "$component"
 done

ci/stage-node-image.py

@@ -18,6 +18,9 @@ GLOBAL_BACKEND_FILES = {
     "NuGet.Config",
     "NuGet.config",
 }
+# The container stages backend as a standalone tree. Copy the repository-wide
+# SDK and package versions into it so restore/publish use the same configuration.
+ROOT_BUILD_FILES = {"Directory.Packages.props", "global.json"}
 CONTAINERFILES = {
     "agent": ROOT / "packaging/container/Agent.NativeBuild.Containerfile",
     "probe": ROOT / "packaging/container/Probe.NativeBuild.Containerfile",
@@ -49,6 +52,10 @@ def stage(component: str, destination: Path) -> None:
         target.parent.mkdir(parents=True, exist_ok=True)
         shutil.copy2(path, target)
 
+    for name in ROOT_BUILD_FILES:
+        for directory in (restore, source):
+            shutil.copy2(ROOT / name, directory / name)
+
     config = destination / "config"
     config.mkdir()
     (config / ".keep").write_text("", encoding="utf-8")