ci: build amd64 on opt-in main commits [CI SKIP]

ci/release-linux.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Publish one framework-dependent Backend OCI image for the requested arch.
+# Build a framework-dependent Backend OCI image for the requested arch; publishing is optional.
 set -euo pipefail
 
 arch="${1:?usage: release-linux.sh <amd64|arm64>}"
@@ -12,16 +12,21 @@ if [[ -n "$tag" ]]; then
   }
   version="${tag#v}"
 else
-  [[ ("${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main) || \
-     ("${CI_PIPELINE_EVENT:-}" == pull_request_closed && "${CI_COMMIT_BRANCH:-}" == main && "${FASTLANE_MERGED_PR:-}" == true) ]] || {
-    echo "untagged image builds are restricted to main pushes and merged PRs" >&2
+  [[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
+    echo "untagged backend builds require a main push with [CI] in the commit message" >&2
     exit 2
   }
   version=main
 fi
-[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
-  echo "Zot credentials are required" >&2; exit 2;
+image_publish="${IMAGE_PUBLISH:-true}"
+[[ "$image_publish" == true || "$image_publish" == false ]] || {
+  echo "IMAGE_PUBLISH must be true or false" >&2; exit 2;
 }
+if [[ "$image_publish" == true ]]; then
+  [[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
+    echo "Zot credentials are required" >&2; exit 2;
+  }
+fi
 case "$arch" in
   amd64|arm64) ;;
   *) echo "unsupported architecture: $arch" >&2; exit 2 ;;
@@ -56,6 +61,15 @@ buildah_home="${BUILDAH_HOME:-/home/justme/woodpecker/buildah-home/$arch}"
 mkdir -p "$buildah_home"
 export HOME="$buildah_home"
 
+local_image="localhost/monitor-backend:$version-$arch"
+buildah bud --tls-verify=true --arch "$arch" \
+  --build-arg "APP_VERSION=$version" \
+  -f "$root/packaging/container/Backend.Containerfile" \
+  -t "$local_image" "$container_context"
+if [[ "$image_publish" == false ]]; then
+  echo "built local Backend image for $arch; not publishing it"
+  exit 0
+fi
 export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
 mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
 logged_in=false
@@ -70,11 +84,6 @@ for attempt in 1 2 3 4; do
   fi
 done
 [[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
-local_image="localhost/monitor-backend:$version-$arch"
-buildah bud --tls-verify=true --arch "$arch" \
-  --build-arg "APP_VERSION=$version" \
-  -f "$root/packaging/container/Backend.Containerfile" \
-  -t "$local_image" "$container_context"
 push_tag() {
   local target_tag="$1" pushed=false
   for attempt in 1 2 3; do