ci: configure Woodpecker release pipelines

2026-10-04 22:12:21 +08:00
1 parent 26620707a0
commit 299f86dbee
@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# Build and publish one Linux architecture: Agent/Probe binary archives to
+# Gitea Generic Packages and the matching Backend OCI image to Zot.
+set -euo pipefail
+
+arch="${1:?usage: release-linux.sh <amd64|arm64>}"
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+version="${CI_COMMIT_TAG#v}"
+[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+
+[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || { echo "Zot credentials are required" >&2; exit 2; }
+
+gitea_base="${GITEA_BASE:-https://git.oeo.one}"
+gitea_host="${gitea_base#https://}"
+gitea_host="${gitea_host#http://}"
+gitea_host="${gitea_host%%/*}"
+gitea_host="${gitea_host%%:*}"
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+image="${registry}/monitor/monitor-backend"
+output="$root/.release/linux-$arch"
+build_root="$root/.release/build/linux-$arch"
+stage_root="$root/.release/stage/linux-$arch"
+rid="linux-x64"
+objcopy="llvm-objcopy"
+if [[ "$arch" == arm64 ]]; then
+  rid="linux-arm64"
+  objcopy="aarch64-linux-gnu-objcopy"
+elif [[ "$arch" != amd64 ]]; then
+  echo "unsupported architecture: $arch" >&2
+  exit 2
+fi
+
+project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
+if [[ "$version" != "$project_version" ]]; then
+  echo "tag version $version does not match project version $project_version" >&2
+  exit 1
+fi
+
+mkdir -p "$output" "$build_root" "$stage_root"
+
+publish_aot() {
+  local name="$1" project="$2" destination="$3"
+  (cd "$root/backend" && dotnet publish "$project" \
+    -c Release -r "$rid" --self-contained true \
+    -p:PublishAot=true -p:StripSymbols=true -p:DebugType=none \
+    -p:ObjCopyName="$objcopy" \
+    --artifacts-path "$build_root/$name" \
+    -o "$destination")
+}
+
+publish_aot agent agent/src/Monitor.Agent "$output/agent"
+publish_aot probe probe/src/Monitor.Probe "$output/probe"
+publish_aot fleet-enroll fleet/tools/fleet-enroll "$output/fleet-enroll"
+publish_aot backend src/Monitor.Backend "$output/backend"
+
+package_node() {
+  local role="$1" stage="$stage_root/$1"
+  mkdir -p "$stage/systemd"
+  cp "$output/$role/monitor-$role" "$stage/monitor-$role"
+  cp "$root/packaging/install.sh" "$stage/install.sh"
+  cp "$root/LICENSE" "$stage/LICENSE"
+  cp "$root/backend/$role/README.md" "$stage/README.md"
+  cp "$root/packaging/systemd/monitor-$role.service" "$stage/systemd/monitor-$role.service"
+  if [[ "$role" == agent ]]; then
+    cp "$output/fleet-enroll/fleet-enroll" "$stage/fleet-enroll"
+  else
+    mkdir -p "$stage/openwrt"
+    cp "$root/packaging/openwrt/monitor-probe.init" "$stage/openwrt/"
+    cp "$root/packaging/openwrt/monitor.keep" "$stage/openwrt/"
+  fi
+
+  local archive="$output/monitor-$role-v$version-linux-$arch.tar.gz"
+  tar -C "$stage" -czf "$archive" .
+  (cd "$output" && sha256sum "$(basename "$archive")" > "$(basename "$archive").sha256")
+  upload_package "$archive"
+  upload_package "$archive.sha256"
+}
+
+netrc="$(mktemp)"
+chmod 600 "$netrc"
+printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
+cleanup() { rm -f "$netrc"; }
+trap cleanup EXIT
+
+upload_package() {
+  local file="$1" name
+  name="$(basename "$file")"
+  curl --fail-with-body --retry 3 --netrc-file "$netrc" \
+    --upload-file "$file" \
+    "$gitea_base/api/packages/justme/generic/monitor-node/$version/$name" >/dev/null
+  echo "uploaded Gitea package $name"
+}
+
+package_node agent
+package_node probe
+
+# The .NET runtime-deps image is a multi-arch OCI base. The Containerfile does
+# not execute target-platform commands, so Buildah can assemble either image.
+container_context="$root/.release/container/linux-$arch"
+mkdir -p "$container_context/app" "$container_context/data"
+cp -a "$output/backend/." "$container_context/app/"
+cp "$root/packaging/container/data/.keep" "$container_context/data/.keep"
+
+export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
+mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
+buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null
+local_image="localhost/monitor-backend:$version-$arch"
+buildah bud --tls-verify=false --arch "$arch" \
+  --build-arg "APP_VERSION=$version" \
+  -f "$root/packaging/container/Backend.Containerfile" \
+  -t "$local_image" "$container_context" >/dev/null
+buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null
+echo "pushed Zot image $image:$version-$arch"