feat(ci): publish ARM64 development node images [CI] [SKIP TESTS]

ci/publish-dev-node-index.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Publish the pullable multi-architecture development tags for Agent or Probe.
+set -euo pipefail
+
+component="${1:?usage: publish-dev-node-index.sh <agent|probe>}"
+case "$component" in
+  agent|probe) ;;
+  *) echo "unsupported component: $component" >&2; exit 2 ;;
+esac
+[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
+  echo "development node indexes require a main push with [CI] in the commit message" >&2
+  exit 2
+}
+[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || {
+  echo "CI_COMMIT_SHA must be a full commit SHA" >&2
+  exit 2
+}
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
+  echo "Zot credentials are required" >&2
+  exit 2
+}
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "$root/ci/version.sh"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
+repository="$registry/moshiro-dev/moshiro-$component"
+work="$root/.release/dev-image-index/$component"
+home="/home/justme/woodpecker/buildah-home/dev-node-index-$component"
+export HOME="$home"
+export REGISTRY_AUTH_FILE="$work/auth.json"
+mkdir -p "$work" "$home"
+
+logged_in=false
+for attempt in 1 2 3 4; do
+  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
+    logged_in=true
+    break
+  fi
+  if [[ "$attempt" -lt 4 ]]; then
+    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
+    sleep 3
+  fi
+done
+[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
+
+manifest="localhost/moshiro-$component:$MOSHIRO_VERSION-multiarch"
+buildah manifest rm "$manifest" >/dev/null 2>&1 || true
+buildah manifest create "$manifest" >/dev/null
+buildah manifest add "$manifest" "docker://$repository:$MOSHIRO_VERSION-amd64" >/dev/null
+buildah manifest add "$manifest" "docker://$repository:$MOSHIRO_VERSION-arm64" >/dev/null
+
+push_tag() {
+  local tag="$1"
+  buildah manifest push --all --format oci --digestfile "$work/$component.digest" \
+    "$manifest" "docker://$repository:$tag" >/dev/null
+  echo "published multi-architecture development image $repository:$tag"
+}
+
+push_tag "$MOSHIRO_VERSION"
+push_tag latest
+buildah manifest rm "$manifest" >/dev/null
+
+if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
+  bash "$root/ci/publish-release-offer.sh" "$component" "$repository" \
+    "$(cat "$work/$component.digest")" "$MOSHIRO_TAG" dev "$work/release"
+fi