ci: publish main amd64 images to dev Zot [CI SKIP]

ci/build-main-amd64.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Build one Linux amd64 runtime image locally for an opt-in main commit.
+# Build and push one opt-in main Linux amd64 image to the dev repository in Zot.
 set -euo pipefail
 
 [[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
@@ -12,14 +12,31 @@ case "$component" in
   backend|agent|probe) ;;
   *) echo "unsupported component: $component" >&2; exit 2 ;;
 esac
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
+  echo "Zot credentials are required" >&2
+  exit 2
+}
+[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || {
+  echo "CI_COMMIT_SHA must be a full commit SHA" >&2
+  exit 2
+}
 
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
+repository="$registry/monitor-dev/monitor-$component"
 work="$root/.release/main-amd64-build"
 base_home="/home/justme/woodpecker/buildah-home/main-amd64-build-$component"
+short_sha="${CI_COMMIT_SHA:0:12}"
+dev_tag="dev-$short_sha"
 mkdir -p "$work" "$base_home"
 
 if [[ "$component" == backend ]]; then
-  BUILDAH_HOME="$base_home" IMAGE_PUBLISH=false bash "$root/ci/release-linux.sh" amd64 backend
+  BUILDAH_HOME="$base_home" \
+    ZOT_REGISTRY="$registry" \
+    ZOT_IMAGE_REPOSITORY="$repository" \
+    IMAGE_TAGS="latest,$dev_tag" \
+    IMAGE_PUBLISH=true \
+    bash "$root/ci/release-linux.sh" amd64 backend
   exit 0
 fi
 
@@ -27,10 +44,39 @@ export HOME="$base_home"
 export BUILDAH_HOME="$base_home"
 export REGISTRY_AUTH_FILE="$work/$component-auth.json"
 context="$work/$component"
+local_image="localhost/monitor-$component:main-amd64-check"
 
 python3 "$root/ci/stage-node-image.py" "$component" "$context"
 buildah bud --layers --network host --tls-verify=true --arch amd64 \
   --build-arg APP_VERSION=main \
   -f "$context/Containerfile" \
-  -t "localhost/monitor-$component:main-amd64-check" "$context"
-echo "built local Linux amd64 $component image; not publishing it"
+  -t "$local_image" "$context"
+
+logged_in=false
+for attempt in 1 2 3 4; do
+  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
+    logged_in=true
+    break
+  fi
+  if [[ "$attempt" -lt 4 ]]; then
+    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
+    sleep 3
+  fi
+done
+[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
+
+for tag in latest "$dev_tag"; do
+  pushed=false
+  for attempt in 1 2 3; do
+    if buildah push --tls-verify=true "$local_image" "docker://$repository:$tag"; then
+      pushed=true
+      break
+    fi
+    if [[ "$attempt" -lt 3 ]]; then
+      echo "Zot push for $component:$tag attempt $attempt failed; retrying in 5 seconds" >&2
+      sleep 5
+    fi
+  done
+  [[ "$pushed" == true ]] || { echo "could not push $repository:$tag after 3 attempts" >&2; exit 1; }
+  echo "pushed development image $repository:$tag"
+done

ci/release-linux.sh

@@ -39,7 +39,7 @@ if [[ -n "$tag" && "$version" != "$project_version" ]]; then
 fi
 
 registry="${ZOT_REGISTRY:-registry.oeo.one}"
-image="$registry/monitor/monitor-backend"
+image="${ZOT_IMAGE_REPOSITORY:-$registry/monitor/monitor-backend}"
 output="$root/.release/linux-$arch/backend"
 build_root="$root/.release/build/linux-$arch-backend"
 container_context="$root/.release/container/linux-$arch"
@@ -100,7 +100,19 @@ push_tag() {
   echo "pushed Zot image $image:$target_tag"
 }
 
-push_tag "$version-$arch"
-if [[ -z "$tag" ]]; then
-  push_tag "$version"
+if [[ -n "${IMAGE_TAGS:-}" ]]; then
+  IFS=',' read -r -a image_tags <<< "$IMAGE_TAGS"
+  ((${#image_tags[@]} > 0)) || { echo "IMAGE_TAGS must contain at least one tag" >&2; exit 2; }
+  for image_tag in "${image_tags[@]}"; do
+    [[ "$image_tag" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]] || {
+      echo "invalid image tag: $image_tag" >&2
+      exit 2
+    }
+    push_tag "$image_tag"
+  done
+else
+  push_tag "$version-$arch"
+  if [[ -z "$tag" ]]; then
+    push_tag "$version"
+  fi
 fi