ci: build musl only for arm64 and reuse toolchain cache [CI]

ci/Bundle-QuicRuntime.ps1

@@ -1,6 +1,6 @@
 param(
     [Parameter(Mandatory)]
-    [ValidateSet('linux-x64', 'linux-arm64', 'linux-musl-x64', 'linux-musl-arm64')]
+    [ValidateSet('linux-x64', 'linux-arm64', 'linux-musl-arm64')]
     [string]$RuntimeIdentifier,
     [Parameter(Mandatory)]
     [string]$Destination

ci/build-linux-agent.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 # One native build/package path for glibc and musl, used by development and tags.
 set -euo pipefail
-rid="${1:?usage: build-linux-agent.sh <linux-x64|linux-arm64|linux-musl-x64|linux-musl-arm64>}"
+rid="${1:?usage: build-linux-agent.sh <linux-x64|linux-arm64|linux-musl-arm64>}"
 case "$rid" in
   linux-x64|linux-arm64) static_msquic=false ;;
-  linux-musl-x64|linux-musl-arm64) static_msquic=true ;;
+  linux-musl-arm64) static_msquic=true ;;
   *) echo "unsupported Linux RID: $rid" >&2; exit 2 ;;
 esac
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -35,14 +35,20 @@ trap cleanup EXIT
 context="$work/context"
 # Serialize toolchain import/build; the native jobs use its resolved immutable ID.
 exec 7> "$base_home/.toolchain.lock"
+echo "[$rid] waiting for the shared NativeAOT toolchain lock"
 flock -w 1800 7
+echo "[$rid] acquired the toolchain lock; checking the local cache"
 builder_image="localhost/moshiro-dotnet10-nativeaot-aotanywhere:ci"
 source "$root/ci/nativeaot-toolchain.sh"
 moshiro_nativeaot_settings "$root"
 builder_cache="${MOSHIRO_RUNNER_IMAGE_CACHE:-/home/justme/woodpecker/cache/runner-image}"
 cached_key="$(cat "$builder_cache/nativeaot-builder.key" 2>/dev/null || true)"
 builder_id="$(cat "$builder_cache/nativeaot-builder.id" 2>/dev/null || true)"
-if [[ "$cached_key" == "$MOSHIRO_NATIVEAOT_BUILDER_KEY" && "$builder_id" =~ ^[0-9a-f]{64}$ && -f "$builder_cache/nativeaot-builder-$builder_id.oci" ]]; then
+local_key="$(cat "$base_home/nativeaot-builder.key" 2>/dev/null || true)"
+local_builder_id="$(buildah images --noheading --no-trunc --format '{{.ID}}' "$builder_image" 2>/dev/null || true)"
+if [[ "$local_key" == "$MOSHIRO_NATIVEAOT_BUILDER_KEY" && "${local_builder_id#sha256:}" =~ ^[0-9a-f]{64}$ ]]; then
+  echo "[$rid] reusing the toolchain already built in this store"
+elif [[ "$cached_key" == "$MOSHIRO_NATIVEAOT_BUILDER_KEY" && "$builder_id" =~ ^[0-9a-f]{64}$ && -f "$builder_cache/nativeaot-builder-$builder_id.oci" ]]; then
   local_builder_id="$(buildah images --noheading --no-trunc --format '{{.ID}}' "$builder_image" 2>/dev/null || true)"
   if [[ "${local_builder_id#sha256:}" != "$builder_id" ]]; then
     python3 "$root/ci/run-with-timeout.py" 600 buildah pull "oci-archive:$builder_cache/nativeaot-builder-$builder_id.oci"
@@ -53,13 +59,17 @@ else
   builder_context="$work/nativeaot-builder"
   mkdir -p "$builder_context"
   tr -d '\r' < "$root/global.json" > "$builder_context/global.json"
-  python3 "$root/ci/run-with-timeout.py" 1800 buildah bud --layers --network host --tls-verify=true --arch amd64 \
+  touch -t 200001010000 "$builder_context/global.json"
+  echo "[$rid] preparing the shared toolchain (other targets wait for this build)"
+  python3 "$root/ci/run-with-timeout.py" 1800 buildah bud --layers --force-rm --network host --tls-verify=true --arch amd64 \
     --build-arg "AOTANYWHERE_VERSION=$MOSHIRO_AOTANYWHERE_VERSION" \
     --build-arg "ZIG_TOOLSET_VERSION=$MOSHIRO_ZIG_TOOLSET_VERSION" \
     -f "$root/packaging/container/NativeAot.Builder.Containerfile" \
     -t "$builder_image" "$builder_context"
 fi
 builder_image="$(buildah images --noheading --no-trunc --format '{{.ID}}' "$builder_image")"
+printf '%s\n' "$MOSHIRO_NATIVEAOT_BUILDER_KEY" > "$base_home/nativeaot-builder.key"
+echo "[$rid] toolchain ready: $builder_image; starting the native build"
 flock -u 7
 exec 7>&-
 

ci/cleanup-build-cache.sh

@@ -2,6 +2,10 @@
 # Caller holds its store lock. Keep recent image layers and persistent RUN caches.
 set -euo pipefail
 : "${CONTAINERS_STORAGE_CONF:?an explicit, locked CI Buildah store is required}"
+# No build is active while the caller holds the exclusive store lock. Remove
+# working containers left by canceled builds before considering old image layers.
+buildah unshare buildah rm --all >/dev/null 2>&1 || true
+buildah rmi localhost/moshiro-agent-binaries:linux-musl-x64 >/dev/null 2>&1 || true
 # prune also deletes RUN cache mounts; remove only expired intermediate layers and versioned application images.
 mapfile -t expired < <(buildah images --all --no-trunc --format '{{.ID}} {{.Created}} {{.Name}}:{{.Tag}}' | python3 -c '
 import re,sys,time

ci/package-linux-agent.sh

@@ -6,7 +6,6 @@ binaries="${2:?}"; destination="${3:?}"
 case "$rid" in
   linux-x64) suffix=amd64 ;;
   linux-arm64) suffix=arm64 ;;
-  linux-musl-x64) suffix=musl-amd64 ;;
   linux-musl-arm64) suffix=musl-arm64 ;;
   *) echo "unsupported Linux RID: $rid" >&2; exit 2 ;;
 esac

ci/publish-gitea-release.sh

@@ -29,7 +29,7 @@ trap 'rm -rf "$tmp"' EXIT
 root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 install_sh="$(sha256sum "$root_dir/packaging/install/install.sh" | cut -d" " -f1)"
 install_ps1="$(sha256sum "$root_dir/packaging/install/install.ps1" | cut -d" " -f1)"
-release_body="Install script SHA-256 (compare with the panel before you run an install command): install.sh $install_sh, install.ps1 $install_ps1. Agent builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). Linux musl Agent OCI image: registry.oeo.one/moshiro/moshiro-agent:$version (linux/amd64 and linux/arm64). Backend OCI image: registry.oeo.one/moshiro/moshiro-backend:$version (linux/amd64 and linux/arm64). Compose files for Agent and Backend: moshiro-compose-<role>.yaml (images use :latest, or pin MOSHIRO_VERSION in .env). macOS binaries are not Developer ID signed or notarized."
+release_body="Install script SHA-256 (compare with the panel before you run an install command): install.sh $install_sh, install.ps1 $install_ps1. Agent builds: Linux glibc (x64, arm64) and musl (arm64), macOS (x64, arm64), and Windows (x64, arm64). Linux Agent OCI image: registry.oeo.one/moshiro/moshiro-agent:$version (linux/amd64 and linux/arm64). Backend OCI image: registry.oeo.one/moshiro/moshiro-backend:$version (linux/amd64 and linux/arm64). Compose files for Agent and Backend: moshiro-compose-<role>.yaml (images use :latest, or pin MOSHIRO_VERSION in .env). macOS binaries are not Developer ID signed or notarized."
 payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MoShiro %s","body":"%s","draft":false,"prerelease":false}' \
   "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$release_body")"
 release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
@@ -65,7 +65,6 @@ curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
 assets=(
   "moshiro-agent-v$version-linux-amd64.tar.gz"
   "moshiro-agent-v$version-linux-arm64.tar.gz"
-  "moshiro-agent-v$version-linux-musl-amd64.tar.gz"
   "moshiro-agent-v$version-linux-musl-arm64.tar.gz"
   "moshiro-agent-v$version-macos-x64.tar.gz"
   "moshiro-agent-v$version-macos-arm64.tar.gz"

ci/publish-openwrt.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 channel="${1:?usage: publish-openwrt.sh <dev|release> <rid> <binary-directory>}"
 rid="${2:?}"; source_dir="${3:?}"
 [[ "$channel" == dev || "$channel" == release ]] || exit 2
-[[ "$rid" == linux-musl-arm64 || "$rid" == linux-musl-x64 ]] || exit 2
+[[ "$rid" == linux-musl-arm64 ]] || exit 2
 if [[ "$channel" == release ]]; then
   [[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo 'release feed requires a stable version tag' >&2; exit 2; }
 else

ci/release-cross-platform.ps1

@@ -2,7 +2,7 @@ param(
     [Parameter(Mandatory)]
     [ValidateSet(
         'linux-x64', 'linux-arm64',
-        'linux-musl-x64', 'linux-musl-arm64',
+        'linux-musl-arm64',
         'osx-x64', 'osx-arm64', 'win-x64', 'win-arm64'
     )]
     [string]$RuntimeIdentifier,

ci/release-node-images.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Publish musl OCI images for the Linux Agent on amd64 and arm64.
+# Publish the Agent's glibc amd64 and musl arm64 OCI images.
 set -euo pipefail
 
 tag="${CI_COMMIT_TAG:-}"
@@ -64,22 +64,29 @@ build_arch_image() {
   local component="$1" arch="$2" suffix="$3"
   local filename="moshiro-$component-v$version-linux-$suffix.tar.gz"
   local context="$work/$component-$arch"
+  local extracted="$work/extracted-$component-$arch"
   local archive="$work/$filename"
   local containerfile="$root/packaging/container/${component^}.Containerfile"
   local image="$image_root/moshiro-$component"
   local local_image="localhost/moshiro-$component:ci-$channel-$arch"
+  local runtime_base=mcr.microsoft.com/dotnet/runtime-deps:10.0
+  [[ "$suffix" != musl-* ]] || runtime_base=mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
   curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
     "$gitea_base/api/packages/justme/generic/moshiro-node/$version/$filename" -o "$archive"
   mkdir -p "$context/app" "$context/config"
-  tar -xzf "$archive" -C "$work"
-  install -m 0755 "$work/fleet-enroll" "$context/app/fleet-enroll"
-  install -m 0755 "$work/moshiro-$component" "$context/app/moshiro-$component"
+  mkdir -p "$extracted"
+  tar -xzf "$archive" -C "$extracted"
+  install -m 0755 "$extracted/fleet-enroll" "$context/app/fleet-enroll"
+  install -m 0755 "$extracted/moshiro-$component" "$context/app/moshiro-$component"
+  for library in "$extracted"/lib*.so.*; do
+    [[ ! -f "$library" ]] || install -m 0644 "$library" "$context/app/"
+  done
   : > "$context/config/.keep"
   install -m 0755 "$root/packaging/container/entrypoint.sh" "$context/entrypoint.sh"
 
   buildah bud --tls-verify=true --arch "$arch" \
-    --build-arg "APP_VERSION=$version" \
+    --build-arg "APP_VERSION=$version" --build-arg "RUNTIME_BASE=$runtime_base" \
     -f "$containerfile" -t "$local_image" "$context" >/dev/null
 
   local pushed=false
@@ -116,7 +123,7 @@ publish_index() {
 }
 
 for component in agent; do
-  build_arch_image "$component" amd64 musl-amd64
+  build_arch_image "$component" amd64 amd64
   build_arch_image "$component" arm64 musl-arm64
   publish_index "$component"
   # 发布清单：给多架构镜像的 digest 签名（私钥只在 CI 密钥里），放进镜像仓库（<仓库>-manifest:release），面板在线时再登记一份加速。

ci/stage-node-image.py

@@ -134,7 +134,7 @@ def normalize_mtimes(directory: Path) -> None:
 def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument("component", choices=tuple(CONTAINERFILES))
-    parser.add_argument("runtime_identifier", choices=("linux-x64", "linux-arm64", "linux-musl-x64", "linux-musl-arm64"))
+    parser.add_argument("runtime_identifier", choices=("linux-x64", "linux-arm64", "linux-musl-arm64"))
     parser.add_argument("destination", type=Path)
     args = parser.parse_args()
     stage(args.component, args.runtime_identifier, args.destination)