ci: configure Woodpecker release pipelines

2026-10-04 22:12:21 +08:00
1 parent 26620707a0
commit 299f86dbee
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Publish a multi-architecture OCI index for the two architecture-specific
+# Backend images already pushed by release-linux.sh.
+set -euo pipefail
+
+version="${CI_COMMIT_TAG#v}"
+[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+scheme="${ZOT_SCHEME:-http}"
+image="monitor/monitor-backend"
+auth_file="$(mktemp)"
+chmod 600 "$auth_file"
+trap 'rm -f "$auth_file"' EXIT
+printf 'machine %s login %s password %s\n' "${registry%%:*}" "$ZOT_USERNAME" "$ZOT_PASSWORD" > "$auth_file"
+
+accept='application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json'
+
+manifest_head() {
+  local tag="$1"
+  curl --silent --show-error --fail --head --netrc-file "$auth_file" \
+    -H "Accept: $accept" "$scheme://$registry/v2/$image/manifests/$tag" \
+    | tr -d '\r' | awk '
+      tolower($1)=="docker-content-digest:" { digest=$2 }
+      tolower($1)=="content-length:" { size=$2 }
+      tolower($1)=="content-type:" { media=$2 }
+      END { if (digest && size && media) print digest, size, media; else exit 1 }'
+}
+
+amd="$(manifest_head "$version-amd64")"
+arm="$(manifest_head "$version-arm64")"
+read -r amd_digest amd_size amd_media <<< "$amd"
+read -r arm_digest arm_size arm_media <<< "$arm"
+index_media='application/vnd.oci.image.index.v1+json'
+body="$(printf '{"schemaVersion":2,"mediaType":"%s","manifests":[{"mediaType":"%s","digest":"%s","size":%s,"platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"%s","digest":"%s","size":%s,"platform":{"architecture":"arm64","os":"linux"}}]}' \
+  "$index_media" "$amd_media" "$amd_digest" "$amd_size" "$arm_media" "$arm_digest" "$arm_size")"
+
+put_tag() {
+  local tag="$1" code
+  code="$(curl --silent --show-error --netrc-file "$auth_file" -o /dev/null -w '%{http_code}' \
+    -H "Content-Type: $index_media" -X PUT --data-binary "$body" \
+    "$scheme://$registry/v2/$image/manifests/$tag")"
+  case "$code" in
+    200|201) echo "published $image:$tag" ;;
+    *) echo "failed to publish $image:$tag (HTTP $code)" >&2; return 1 ;;
+  esac
+}
+
+put_tag "$version"
+if [[ "$version" != *-* ]]; then
+  put_tag latest
+fi
@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# Build and publish one Linux architecture: Agent/Probe binary archives to
+# Gitea Generic Packages and the matching Backend OCI image to Zot.
+set -euo pipefail
+
+arch="${1:?usage: release-linux.sh <amd64|arm64>}"
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+version="${CI_COMMIT_TAG#v}"
+[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+
+[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || { echo "Zot credentials are required" >&2; exit 2; }
+
+gitea_base="${GITEA_BASE:-https://git.oeo.one}"
+gitea_host="${gitea_base#https://}"
+gitea_host="${gitea_host#http://}"
+gitea_host="${gitea_host%%/*}"
+gitea_host="${gitea_host%%:*}"
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+image="${registry}/monitor/monitor-backend"
+output="$root/.release/linux-$arch"
+build_root="$root/.release/build/linux-$arch"
+stage_root="$root/.release/stage/linux-$arch"
+rid="linux-x64"
+objcopy="llvm-objcopy"
+if [[ "$arch" == arm64 ]]; then
+  rid="linux-arm64"
+  objcopy="aarch64-linux-gnu-objcopy"
+elif [[ "$arch" != amd64 ]]; then
+  echo "unsupported architecture: $arch" >&2
+  exit 2
+fi
+
+project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
+if [[ "$version" != "$project_version" ]]; then
+  echo "tag version $version does not match project version $project_version" >&2
+  exit 1
+fi
+
+mkdir -p "$output" "$build_root" "$stage_root"
+
+publish_aot() {
+  local name="$1" project="$2" destination="$3"
+  (cd "$root/backend" && dotnet publish "$project" \
+    -c Release -r "$rid" --self-contained true \
+    -p:PublishAot=true -p:StripSymbols=true -p:DebugType=none \
+    -p:ObjCopyName="$objcopy" \
+    --artifacts-path "$build_root/$name" \
+    -o "$destination")
+}
+
+publish_aot agent agent/src/Monitor.Agent "$output/agent"
+publish_aot probe probe/src/Monitor.Probe "$output/probe"
+publish_aot fleet-enroll fleet/tools/fleet-enroll "$output/fleet-enroll"
+publish_aot backend src/Monitor.Backend "$output/backend"
+
+package_node() {
+  local role="$1" stage="$stage_root/$1"
+  mkdir -p "$stage/systemd"
+  cp "$output/$role/monitor-$role" "$stage/monitor-$role"
+  cp "$root/packaging/install.sh" "$stage/install.sh"
+  cp "$root/LICENSE" "$stage/LICENSE"
+  cp "$root/backend/$role/README.md" "$stage/README.md"
+  cp "$root/packaging/systemd/monitor-$role.service" "$stage/systemd/monitor-$role.service"
+  if [[ "$role" == agent ]]; then
+    cp "$output/fleet-enroll/fleet-enroll" "$stage/fleet-enroll"
+  else
+    mkdir -p "$stage/openwrt"
+    cp "$root/packaging/openwrt/monitor-probe.init" "$stage/openwrt/"
+    cp "$root/packaging/openwrt/monitor.keep" "$stage/openwrt/"
+  fi
+
+  local archive="$output/monitor-$role-v$version-linux-$arch.tar.gz"
+  tar -C "$stage" -czf "$archive" .
+  (cd "$output" && sha256sum "$(basename "$archive")" > "$(basename "$archive").sha256")
+  upload_package "$archive"
+  upload_package "$archive.sha256"
+}
+
+netrc="$(mktemp)"
+chmod 600 "$netrc"
+printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
+cleanup() { rm -f "$netrc"; }
+trap cleanup EXIT
+
+upload_package() {
+  local file="$1" name
+  name="$(basename "$file")"
+  curl --fail-with-body --retry 3 --netrc-file "$netrc" \
+    --upload-file "$file" \
+    "$gitea_base/api/packages/justme/generic/monitor-node/$version/$name" >/dev/null
+  echo "uploaded Gitea package $name"
+}
+
+package_node agent
+package_node probe
+
+# The .NET runtime-deps image is a multi-arch OCI base. The Containerfile does
+# not execute target-platform commands, so Buildah can assemble either image.
+container_context="$root/.release/container/linux-$arch"
+mkdir -p "$container_context/app" "$container_context/data"
+cp -a "$output/backend/." "$container_context/app/"
+cp "$root/packaging/container/data/.keep" "$container_context/data/.keep"
+
+export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
+mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
+buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null
+local_image="localhost/monitor-backend:$version-$arch"
+buildah bud --tls-verify=false --arch "$arch" \
+  --build-arg "APP_VERSION=$version" \
+  -f "$root/packaging/container/Backend.Containerfile" \
+  -t "$local_image" "$container_context" >/dev/null
+buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null
+echo "pushed Zot image $image:$version-$arch"
@@ -0,0 +1,118 @@
+param(
+    [Parameter(Mandatory)]
+    [ValidateSet('amd64', 'arm64')]
+    [string]$Architecture
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
+    throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
+}
+$version = $Matches[1]
+$root = Split-Path -Parent $PSScriptRoot
+$backend = Join-Path $root 'backend'
+$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '<Version>([^<]+)</Version>').Groups[1].Value
+if ($version -ne $projectVersion) {
+    throw "Tag version $version does not match project version $projectVersion."
+}
+if (-not $env:GITEA_TOKEN) {
+    throw 'GITEA_TOKEN is required.'
+}
+
+$rid = if ($Architecture -eq 'amd64') { 'win-x64' } else { 'win-arm64' }
+$vcArchitecture = if ($Architecture -eq 'amd64') { 'x64' } else { 'arm64' }
+$vsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+$vsPath = & $vsWhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+if (-not $vsPath) {
+    throw 'Visual Studio C++ Build Tools were not found.'
+}
+
+$devCmd = Join-Path $vsPath 'Common7\Tools\VsDevCmd.bat'
+$environmentLines = & cmd.exe /d /s /c "call `"$devCmd`" -no_logo -arch=$vcArchitecture -host_arch=x64 && set"
+foreach ($line in $environmentLines) {
+    $separator = $line.IndexOf('=')
+    if ($separator -gt 0) {
+        [Environment]::SetEnvironmentVariable($line.Substring(0, $separator), $line.Substring($separator + 1), 'Process')
+    }
+}
+
+$buildRoot = Join-Path $root ".release\build\windows-$Architecture-$PID"
+$publishRoot = Join-Path $root ".release\windows-$Architecture-$PID"
+$packageRoot = Join-Path $root '.release\packages'
+$null = New-Item -ItemType Directory -Force -Path $publishRoot, $packageRoot
+
+function Publish-Aot([string]$Project, [string]$Output) {
+    $arguments = @(
+        'publish', $Project,
+        '-c', 'Release',
+        '-r', $rid,
+        '--self-contained', 'true',
+        '-p:PublishAot=true',
+        '-p:StripSymbols=true',
+        '-p:DebugType=none',
+        '--artifacts-path', $buildRoot,
+        '-o', $Output
+    )
+    Push-Location $backend
+    try {
+        & dotnet @arguments
+        if ($LASTEXITCODE -ne 0) {
+            throw "NativeAOT publish failed for $Project ($rid)."
+        }
+    }
+    finally {
+        Pop-Location
+    }
+}
+
+$agentOut = Join-Path $publishRoot 'agent'
+$probeOut = Join-Path $publishRoot 'probe'
+$enrollOut = Join-Path $publishRoot 'fleet-enroll'
+$null = New-Item -ItemType Directory -Force -Path $agentOut, $probeOut, $enrollOut
+Publish-Aot 'agent/src/Monitor.Agent' $agentOut
+Publish-Aot 'probe/src/Monitor.Probe' $probeOut
+Publish-Aot 'fleet/tools/fleet-enroll' $enrollOut
+
+$giteaBase = if ($env:GITEA_BASE) { $env:GITEA_BASE.TrimEnd('/') } else { 'https://git.oeo.one' }
+$netrc = Join-Path $env:TEMP ("monitor-gitea-$([guid]::NewGuid().ToString('N')).netrc")
+$giteaHost = ([Uri]$giteaBase).Host
+Set-Content -LiteralPath $netrc -Value "machine $giteaHost login justme password $($env:GITEA_TOKEN)" -Encoding ascii -NoNewline
+
+function Publish-Package([string]$Role, [string]$BinaryDirectory) {
+    $stage = Join-Path $publishRoot "stage-$Role"
+    $null = New-Item -ItemType Directory -Force -Path $stage
+    Copy-Item -LiteralPath (Join-Path $BinaryDirectory "monitor-$Role.exe") -Destination $stage
+    Copy-Item -LiteralPath (Join-Path $root 'LICENSE') -Destination $stage
+    Copy-Item -LiteralPath (Join-Path $root "backend\$Role\README.md") -Destination $stage
+    if ($Role -eq 'agent') {
+        Copy-Item -LiteralPath (Join-Path $enrollOut 'fleet-enroll.exe') -Destination $stage
+    }
+
+    $archiveName = "monitor-$Role-v$version-windows-$Architecture.zip"
+    $archive = Join-Path $packageRoot $archiveName
+    Compress-Archive -Path (Join-Path $stage '*') -DestinationPath $archive -CompressionLevel Optimal -Force
+    $hash = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant()
+    $checksum = "$hash  $archiveName`n"
+    $checksumPath = "$archive.sha256"
+    [IO.File]::WriteAllText($checksumPath, $checksum, [Text.UTF8Encoding]::new($false))
+
+    foreach ($file in @($archive, $checksumPath)) {
+        $name = Split-Path -Leaf $file
+        $url = "$giteaBase/api/packages/justme/generic/monitor-node/$version/$name"
+        & curl.exe --fail-with-body --retry 3 --netrc-file $netrc --upload-file $file $url
+        if ($LASTEXITCODE -ne 0) {
+            throw "Gitea package upload failed for $name."
+        }
+        Write-Output "uploaded Gitea package $name"
+    }
+}
+
+try {
+    Publish-Package 'agent' $agentOut
+    Publish-Package 'probe' $probeOut
+}
+finally {
+    Remove-Item -LiteralPath $netrc -Force -ErrorAction SilentlyContinue
+}