ci: version from the tag or the commits since it; dev images from main gated on tests; recognise -dev. tags [CI SKIP]

2026-10-09 13:20:30 +08:00
1 parent a3338e1cf3
commit a9f78f99df
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Build and push one opt-in Linux amd64 development image (main push with [CI]) to the moshiro-dev repository in Zot.
+set -euo pipefail
+
+[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
+  echo "development image builds require a main push with [CI] in the commit message" >&2
+  exit 2
+}
+
+component="${1:?usage: build-dev-image.sh <backend|agent|probe>}"
+case "$component" in
+  backend|agent|probe) ;;
+  *) echo "unsupported component: $component" >&2; exit 2 ;;
+esac
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
+  echo "Zot credentials are required" >&2
+  exit 2
+}
+[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || {
+  echo "CI_COMMIT_SHA must be a full commit SHA" >&2
+  exit 2
+}
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# 版本：v<下一个补丁版本>-dev.<自最近 tag 的提交数>-<提交前 7 位>（见 ci/version.sh）；写进工作区的 Directory.Build.props，镜像标签、构建信息、签名清单都用它
+source "$root/ci/version.sh"
+moshiro_apply_version
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
+repository="$registry/moshiro-dev/moshiro-$component"
+work="$root/.release/dev-image-build"
+base_home="/home/justme/woodpecker/buildah-home/dev-image-build-$component"
+# 镜像标签不带 v（和正式版一致）：latest 和 <版本>；构建信息和清单里的 tag 带 v
+image_version="$MOSHIRO_VERSION"
+mkdir -p "$work" "$base_home"
+
+if [[ "$component" == backend ]]; then
+  BUILDAH_HOME="$base_home" \
+    ZOT_REGISTRY="$registry" \
+    ZOT_IMAGE_REPOSITORY="$repository" \
+    IMAGE_TAGS="latest,$image_version" \
+    IMAGE_PUBLISH=true \
+    bash "$root/ci/release-linux.sh" amd64 backend
+  exit 0
+fi
+
+export HOME="$base_home"
+export BUILDAH_HOME="$base_home"
+export REGISTRY_AUTH_FILE="$work/$component-auth.json"
+context="$work/$component"
+local_image="localhost/moshiro-$component:dev-amd64-check"
+
+python3 "$root/ci/stage-node-image.py" "$component" "$context"
+buildah bud --layers --network host --tls-verify=true --arch amd64 \
+  --build-arg "APP_VERSION=$image_version" \
+  --build-arg "MOSHIRO_TAG=$MOSHIRO_TAG" --build-arg "MOSHIRO_COMMIT=${CI_COMMIT_SHA:0:10}" --build-arg "MOSHIRO_BUILT_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+  -f "$context/Containerfile" \
+  -t "$local_image" "$context"
+
+logged_in=false
+for attempt in 1 2 3 4; do
+  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
+    logged_in=true
+    break
+  fi
+  if [[ "$attempt" -lt 4 ]]; then
+    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
+    sleep 3
+  fi
+done
+[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
+
+for tag in latest "$image_version"; do
+  pushed=false
+  for attempt in 1 2 3; do
+    if buildah push --tls-verify=true --digestfile "$work/$component.digest" "$local_image" "docker://$repository:$tag"; then
+      pushed=true
+      break
+    fi
+    if [[ "$attempt" -lt 3 ]]; then
+      echo "Zot push for $component:$tag attempt $attempt failed; retrying in 5 seconds" >&2
+      sleep 5
+    fi
+  done
+  [[ "$pushed" == true ]] || { echo "could not push $repository:$tag after 3 attempts" >&2; exit 1; }
+  echo "pushed development image $repository:$tag"
+done
+
+# 发布清单：给镜像的 digest 签名（私钥只在 CI 密钥里），放进镜像仓库（<仓库>-manifest:dev），面板在线时再登记一份加速。
+# 没有配置签名密钥（例如 fork）就只构建镜像、不发清单。
+if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
+  bash "$root/ci/publish-release-offer.sh" "$component" "$repository" "$(cat "$work/$component.digest")" "$MOSHIRO_TAG" dev "$work/$component-release"
+fi