ci: build musl only for arm64 and reuse toolchain cache [CI]

ci/release-node-images.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Publish musl OCI images for the Linux Agent on amd64 and arm64.
+# Publish the Agent's glibc amd64 and musl arm64 OCI images.
 set -euo pipefail
 
 tag="${CI_COMMIT_TAG:-}"
@@ -64,22 +64,29 @@ build_arch_image() {
   local component="$1" arch="$2" suffix="$3"
   local filename="moshiro-$component-v$version-linux-$suffix.tar.gz"
   local context="$work/$component-$arch"
+  local extracted="$work/extracted-$component-$arch"
   local archive="$work/$filename"
   local containerfile="$root/packaging/container/${component^}.Containerfile"
   local image="$image_root/moshiro-$component"
   local local_image="localhost/moshiro-$component:ci-$channel-$arch"
+  local runtime_base=mcr.microsoft.com/dotnet/runtime-deps:10.0
+  [[ "$suffix" != musl-* ]] || runtime_base=mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
   curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
     "$gitea_base/api/packages/justme/generic/moshiro-node/$version/$filename" -o "$archive"
   mkdir -p "$context/app" "$context/config"
-  tar -xzf "$archive" -C "$work"
-  install -m 0755 "$work/fleet-enroll" "$context/app/fleet-enroll"
-  install -m 0755 "$work/moshiro-$component" "$context/app/moshiro-$component"
+  mkdir -p "$extracted"
+  tar -xzf "$archive" -C "$extracted"
+  install -m 0755 "$extracted/fleet-enroll" "$context/app/fleet-enroll"
+  install -m 0755 "$extracted/moshiro-$component" "$context/app/moshiro-$component"
+  for library in "$extracted"/lib*.so.*; do
+    [[ ! -f "$library" ]] || install -m 0644 "$library" "$context/app/"
+  done
   : > "$context/config/.keep"
   install -m 0755 "$root/packaging/container/entrypoint.sh" "$context/entrypoint.sh"
 
   buildah bud --tls-verify=true --arch "$arch" \
-    --build-arg "APP_VERSION=$version" \
+    --build-arg "APP_VERSION=$version" --build-arg "RUNTIME_BASE=$runtime_base" \
     -f "$containerfile" -t "$local_image" "$context" >/dev/null
 
   local pushed=false
@@ -116,7 +123,7 @@ publish_index() {
 }
 
 for component in agent; do
-  build_arch_image "$component" amd64 musl-amd64
+  build_arch_image "$component" amd64 amd64
   build_arch_image "$component" arm64 musl-arm64
   publish_index "$component"
   # 发布清单：给多架构镜像的 digest 签名（私钥只在 CI 密钥里），放进镜像仓库（<仓库>-manifest:release），面板在线时再登记一份加速。