ci: configure Woodpecker release pipelines

ci/index-backend-image.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Publish a multi-architecture OCI index for the two architecture-specific
+# Backend images already pushed by release-linux.sh.
+set -euo pipefail
+
+version="${CI_COMMIT_TAG#v}"
+[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+scheme="${ZOT_SCHEME:-http}"
+image="monitor/monitor-backend"
+auth_file="$(mktemp)"
+chmod 600 "$auth_file"
+trap 'rm -f "$auth_file"' EXIT
+printf 'machine %s login %s password %s\n' "${registry%%:*}" "$ZOT_USERNAME" "$ZOT_PASSWORD" > "$auth_file"
+
+accept='application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json'
+
+manifest_head() {
+  local tag="$1"
+  curl --silent --show-error --fail --head --netrc-file "$auth_file" \
+    -H "Accept: $accept" "$scheme://$registry/v2/$image/manifests/$tag" \
+    | tr -d '\r' | awk '
+      tolower($1)=="docker-content-digest:" { digest=$2 }
+      tolower($1)=="content-length:" { size=$2 }
+      tolower($1)=="content-type:" { media=$2 }
+      END { if (digest && size && media) print digest, size, media; else exit 1 }'
+}
+
+amd="$(manifest_head "$version-amd64")"
+arm="$(manifest_head "$version-arm64")"
+read -r amd_digest amd_size amd_media <<< "$amd"
+read -r arm_digest arm_size arm_media <<< "$arm"
+index_media='application/vnd.oci.image.index.v1+json'
+body="$(printf '{"schemaVersion":2,"mediaType":"%s","manifests":[{"mediaType":"%s","digest":"%s","size":%s,"platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"%s","digest":"%s","size":%s,"platform":{"architecture":"arm64","os":"linux"}}]}' \
+  "$index_media" "$amd_media" "$amd_digest" "$amd_size" "$arm_media" "$arm_digest" "$arm_size")"
+
+put_tag() {
+  local tag="$1" code
+  code="$(curl --silent --show-error --netrc-file "$auth_file" -o /dev/null -w '%{http_code}' \
+    -H "Content-Type: $index_media" -X PUT --data-binary "$body" \
+    "$scheme://$registry/v2/$image/manifests/$tag")"
+  case "$code" in
+    200|201) echo "published $image:$tag" ;;
+    *) echo "failed to publish $image:$tag (HTTP $code)" >&2; return 1 ;;
+  esac
+}
+
+put_tag "$version"
+if [[ "$version" != *-* ]]; then
+  put_tag latest
+fi