From da353d239a382c1cecd92be517a3eafffeb0ed2b Mon Sep 17 00:00:00 2001 From: JustMe Date: Sat, 10 Oct 2026 15:51:10 +0800 Subject: [PATCH] ci: isolate caches and trust ARM Alpine keys [CI] [SKIP TESTS] Signed-off-by: JustMe --- ci/build-dev-image.sh | 4 +++- .../container/Agent.NativeBuild.Containerfile | 16 +++++++++++++--- .../container/Probe.NativeBuild.Containerfile | 16 +++++++++++++--- 3 files changed, 29 insertions(+), 7 deletions(-) diff --git a/ci/build-dev-image.sh b/ci/build-dev-image.sh index 7e9e21c..ee57a22 100644 --- a/ci/build-dev-image.sh +++ b/ci/build-dev-image.sh @@ -59,7 +59,9 @@ context="$work/$component" local_image="localhost/moshiro-$component:dev-$arch-check" node_rid="linux-musl-x64" [[ "$arch" == arm64 ]] && node_rid="linux-musl-arm64" -nuget_cache="${NUGET_PACKAGES:-/home/justme/.nuget/packages}" +# Keep writable NuGet caches isolated per parallel build (component + arch). +# Reuse still applies across pipeline runs without concurrent restore races. +nuget_cache="$base_home/nuget-packages" mkdir -p "$nuget_cache" # A stable timestamp lets a retry of the same commit reuse the publish layer. diff --git a/packaging/container/Agent.NativeBuild.Containerfile b/packaging/container/Agent.NativeBuild.Containerfile index 14e553e..733a9e5 100644 --- a/packaging/container/Agent.NativeBuild.Containerfile +++ b/packaging/container/Agent.NativeBuild.Containerfile @@ -1,22 +1,32 @@ # Run all build commands on the native amd64 runner. AotAnywhere cross-links # the NativeAOT output, so an ARM64 build never needs QEMU. +FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys + FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-alpine-aot AS build WORKDIR /src/backend COPY restore/backend/ ./ ARG NODE_RID=linux-musl-x64 ENV NUGET_PACKAGES=/root/.nuget/packages +COPY --from=arm64-apk-keys /usr/share/apk/keys/aarch64 /tmp/apk-keys-arm64 # restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」 RUN dotnet restore agent/src/MoShiro.Agent -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \ && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts # Fetch target-musl runtime libraries on the native builder before copying # application sources. This layer stays reusable when only app code changes. -RUN apk_arch=x86_64; \ +RUN set -eu; \ + apk_arch=x86_64; \ case "$NODE_RID" in *arm64) apk_arch=aarch64 ;; esac; \ mkdir -p /tmp/runtime-apks /tmp/runtime-root /out/runtime; \ - apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \ - for package in /tmp/runtime-apks/*.apk; do tar -xzf "$package" -C /tmp/runtime-root; done; \ + if [ "$apk_arch" = aarch64 ]; then \ + apk --keys-dir /tmp/apk-keys-arm64 --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \ + else \ + apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \ + fi; \ + set -- /tmp/runtime-apks/*.apk; \ + [ -f "$1" ]; \ + for package do tar -xzf "$package" -C /tmp/runtime-root; done; \ cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/ COPY source/backend/ ./ diff --git a/packaging/container/Probe.NativeBuild.Containerfile b/packaging/container/Probe.NativeBuild.Containerfile index ce7dad6..5f450c3 100644 --- a/packaging/container/Probe.NativeBuild.Containerfile +++ b/packaging/container/Probe.NativeBuild.Containerfile @@ -1,22 +1,32 @@ # Run all build commands on the native amd64 runner. AotAnywhere cross-links # the NativeAOT output, so an ARM64 build never needs QEMU. +FROM --platform=linux/arm64 alpine:3.24 AS arm64-apk-keys + FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0-alpine-aot AS build WORKDIR /src/backend COPY restore/backend/ ./ ARG NODE_RID=linux-musl-x64 ENV NUGET_PACKAGES=/root/.nuget/packages +COPY --from=arm64-apk-keys /usr/share/apk/keys/aarch64 /tmp/apk-keys-arm64 # restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」 RUN dotnet restore probe/src/MoShiro.Probe -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts \ && dotnet restore fleet/tools/fleet-enroll -r "$NODE_RID" -p:PublishAot=true -p:UseAotAnywhere=true --artifacts-path /artifacts # Fetch target-musl runtime libraries on the native builder before copying # application sources. This layer stays reusable when only app code changes. -RUN apk_arch=x86_64; \ +RUN set -eu; \ + apk_arch=x86_64; \ case "$NODE_RID" in *arm64) apk_arch=aarch64 ;; esac; \ mkdir -p /tmp/runtime-apks /tmp/runtime-root /out/runtime; \ - apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \ - for package in /tmp/runtime-apks/*.apk; do tar -xzf "$package" -C /tmp/runtime-root; done; \ + if [ "$apk_arch" = aarch64 ]; then \ + apk --keys-dir /tmp/apk-keys-arm64 --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \ + else \ + apk --arch "$apk_arch" fetch --recursive --output /tmp/runtime-apks libmsquic numactl lttng-ust zlib; \ + fi; \ + set -- /tmp/runtime-apks/*.apk; \ + [ -f "$1" ]; \ + for package do tar -xzf "$package" -C /tmp/runtime-root; done; \ cp -a /tmp/runtime-root/usr/lib/*.so* /out/runtime/ COPY source/backend/ ./