backend: require confirmation for signed channel updates [CI]

ci/build-main-amd64.sh

@@ -31,6 +31,7 @@ dev_tag="dev-$short_sha"
 mkdir -p "$work" "$base_home"
 
 if [[ "$component" == backend ]]; then
+  export MOSHIRO_TAG="$dev_tag"
   BUILDAH_HOME="$base_home" \
     ZOT_REGISTRY="$registry" \
     ZOT_IMAGE_REPOSITORY="$repository" \

ci/index-backend-image.sh

@@ -53,3 +53,8 @@ put_tag "$version"
 if [[ "$version" != *-* ]]; then
   put_tag latest
 fi
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+backend_manifest="$(manifest_head "$version")"
+read -r backend_digest _ _ <<< "$backend_manifest"
+bash "$root/ci/publish-release-offer.sh" backend "$registry/$image" "$backend_digest" "$CI_COMMIT_TAG" release "$root/.release/backend-release"

ci/publish-release-offer.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# CI 发布 webhook：镜像已推送成功后，签名并登记清单。面板不会因此自动重启 Backend。
+set -euo pipefail
+component="${1:?component}"; repository="${2:?repository}"; digest="${3:?digest}"; tag="${4:?tag}"; channel="${5:?channel}"; outdir="${6:?outdir}"
+[[ -n "${RELEASE_SIGNING_KEY:-}" ]] || { echo "release signing is not configured; no update offer published"; exit 0; }
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+bash "$root/ci/release-manifest.sh" "$component" "$repository" "$digest" "$tag" "$channel" "$outdir"
+if [[ -n "${RELEASE_API_URL:-}" && -n "${RELEASE_API_TOKEN:-}" ]]; then
+  python3 -c 'import json,sys; print(json.dumps({"manifest": open(sys.argv[1]).read(), "signature": open(sys.argv[2]).read()}))' \
+    "$outdir/manifest.json" "$outdir/manifest.sig" > "$outdir/payload.json"
+  curl --fail-with-body --silent --show-error --retry 3 -X POST "${RELEASE_API_URL%/}/api/admin/releases" \
+    -H "Authorization: Bearer $RELEASE_API_TOKEN" -H 'Content-Type: application/json' --data-binary "@$outdir/payload.json" >/dev/null
+  echo "registered the signed $component release with the panel ($channel)"
+fi

ci/release-linux.sh

@@ -95,7 +95,7 @@ done
 push_tag() {
   local target_tag="$1" pushed=false
   for attempt in 1 2 3; do
-    if buildah push --tls-verify=true "$local_image" "docker://$image:$target_tag"; then
+    if buildah push --tls-verify=true --digestfile "$output/image.digest" "$local_image" "docker://$image:$target_tag"; then
       pushed=true
       break
     fi
@@ -124,3 +124,7 @@ else
     push_tag "$version"
   fi
 fi
+
+if [[ -z "$tag" ]]; then
+  bash "$root/ci/publish-release-offer.sh" backend "$image" "$(cat "$output/image.digest")" "$MOSHIRO_TAG" dev "$output/release"
+fi