ci: gate parallel releases on verified commits

ci/wait-for-verified-commit.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Start release builds only after this exact commit passed push verification.
+set -euo pipefail
+
+[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release preflight must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+[[ -n "${CI_COMMIT_SHA:-}" ]] || { echo "CI_COMMIT_SHA is required" >&2; exit 2; }
+[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
+
+gitea_base="${GITEA_BASE:-http://192.168.2.162:3100}"
+gitea_base="${gitea_base%/}"
+gitea_host="${gitea_base#https://}"
+gitea_host="${gitea_host#http://}"
+gitea_host="${gitea_host%%/*}"
+gitea_host="${gitea_host%%:*}"
+tmp="$(mktemp -d)"
+netrc="$tmp/netrc"
+statuses_json="$tmp/statuses.json"
+chmod 700 "$tmp"
+printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
+chmod 600 "$netrc"
+trap 'rm -rf "$tmp"' EXIT
+
+verification=""
+for attempt in $(seq 1 36); do
+  curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+    "$gitea_base/api/v1/repos/justme/MyMonitor/commits/$CI_COMMIT_SHA/statuses" \
+    -o "$statuses_json"
+  verification="$(jq -r '[.[] | select(.context == "ci/woodpecker/push/verify")] | sort_by(.created_at) | last | .status // ""' "$statuses_json")"
+  case "$verification" in
+    success)
+      echo "push verification passed for ${CI_COMMIT_SHA:0:7}"
+      exit 0
+      ;;
+    failure|error)
+      echo "source commit push verification is $verification" >&2
+      exit 1
+      ;;
+    *)
+      if [[ "$attempt" == 36 ]]; then
+        echo "timed out waiting for push verification (last status: ${verification:-missing})" >&2
+        exit 1
+      fi
+      sleep 10
+      ;;
+  esac
+done