scripts: unify Linux native builds and retain restore caches [CI]

Build musl and glibc for amd64 and arm64 through one native package path. Reuse musl outputs for OCI images and OpenWrt installers, and export binaries inside a rootless unshare session.

Restore the executable dependency graph into a shared persistent NuGet cache, build managed dependencies once, and run isolated native publishes in parallel.

Clean temporary outputs and expired image layers under store locks, retire inactive legacy stores after seven days, and retain two toolchain exports. Add regression coverage for staging, extraction, packaging and cleanup boundaries.

ci/release-node-images.sh

@@ -3,21 +3,26 @@
 set -euo pipefail
 
 tag="${CI_COMMIT_TAG:-}"
-[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
-  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
-  exit 2
-}
+channel=release
+namespace=moshiro
+if [[ -z "$tag" ]]; then
+  [[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *'[CI]'* ]] || exit 2
+  channel=dev
+  namespace=moshiro-dev
+else
+  [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || exit 2
+fi
 [[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
 [[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
   echo "Zot credentials are required" >&2
   exit 2
 }
 
-version="${tag#v}"
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# 版本取自 tag：写进工作区的 Directory.Build.props（仓库里的 <Version> 只是占位，发版不用再提交 bump）
+# Native packages and OCI tags use the same deterministic CI version.
 source "$root/ci/version.sh"
-moshiro_apply_version
+version="$MOSHIRO_VERSION"
+tag="$MOSHIRO_TAG"
 
 gitea_base="${GITEA_BASE:-http://127.0.0.1:3100}"
 gitea_base="${gitea_base%/}"
@@ -26,12 +31,13 @@ gitea_host="${gitea_host#http://}"
 gitea_host="${gitea_host%%/*}"
 gitea_host="${gitea_host%%:*}"
 registry="${ZOT_REGISTRY:-registry.oeo.one}"
-image_root="$registry/moshiro"
-work="$root/.release/node-images"
+image_root="$registry/$namespace"
+work="$root/.release/node-images/$channel"
 netrc="$work/netrc"
-buildah_home="/home/justme/woodpecker/buildah-home/node-images"
+buildah_home="/home/justme/woodpecker/buildah-home/node-images-$channel"
 mkdir -p "$buildah_home"
-export HOME="$buildah_home"
+exec 9> "$buildah_home/.lock"
+flock -w 1800 9
 source "$root/ci/buildah-env.sh"
 moshiro_setup_buildah "$buildah_home"
 mkdir -p "$work"
@@ -61,7 +67,7 @@ build_arch_image() {
   local archive="$work/$filename"
   local containerfile="$root/packaging/container/${component^}.Containerfile"
   local image="$image_root/moshiro-$component"
-  local local_image="localhost/moshiro-$component:$version-$arch"
+  local local_image="localhost/moshiro-$component:ci-$channel-$arch"
 
   curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
     "$gitea_base/api/packages/justme/generic/moshiro-node/$version/$filename" -o "$archive"
@@ -69,12 +75,6 @@ build_arch_image() {
   tar -xzf "$archive" -C "$work"
   install -m 0755 "$work/fleet-enroll" "$context/app/fleet-enroll"
   install -m 0755 "$work/moshiro-$component" "$context/app/moshiro-$component"
-  install -m 0644 "$work"/lib*.so.* "$context/app/"
-  if [[ "$component" == agent && -n "${RELEASE_SIGNING_KEY:-}" && "$version" != *-* ]]; then
-    native_rid=linux-musl-x64
-    [[ "$arch" != arm64 ]] || native_rid=linux-musl-arm64
-    bash "$root/ci/publish-openwrt.sh" release "$native_rid" "$context/app"
-  fi
   : > "$context/config/.keep"
   install -m 0755 "$root/packaging/container/entrypoint.sh" "$context/entrypoint.sh"
 
@@ -105,12 +105,12 @@ publish_index() {
   buildah manifest add "$manifest" "docker://$image:$version-amd64" >/dev/null
   buildah manifest add "$manifest" "docker://$image:$version-arm64" >/dev/null
   buildah manifest push --all --format oci --digestfile "$work/$component.digest" "$manifest" "docker://$image:$version" >/dev/null
-  if [[ "$version" != *-* ]]; then
+  if [[ "$channel" == dev || "$version" != *-* ]]; then
     buildah manifest push --all --format oci "$manifest" "docker://$image:latest" >/dev/null
   fi
   buildah manifest rm "$manifest" >/dev/null
   echo "published multi-architecture index $image:$version"
-  if [[ "$version" != *-* ]]; then
+  if [[ "$channel" == dev || "$version" != *-* ]]; then
     echo "published multi-architecture index $image:latest"
   fi
 }
@@ -123,6 +123,8 @@ for component in agent; do
   # 没有配置签名密钥（例如 fork）就只发镜像、不发清单。
   if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
     digest="$(cat "$work/$component.digest")"
-    bash "$root/ci/publish-release-offer.sh" "$component" "$image_root/moshiro-$component" "$digest" "$tag" release "$work/$component-release"
+    bash "$root/ci/publish-release-offer.sh" "$component" "$image_root/moshiro-$component" "$digest" "$tag" "$channel" "$work/$component-release"
   fi
 done
+
+bash "$root/ci/cleanup-build-cache.sh"