138 lines
5.5 KiB
Bash
138 lines
5.5 KiB
Bash
#!/usr/bin/env bash
|
|
# Publish the Agent's glibc amd64 and musl arm64 OCI images.
|
|
set -euo pipefail
|
|
|
|
tag="${CI_COMMIT_TAG:-}"
|
|
channel=release
|
|
namespace=moshiro
|
|
if [[ -z "$tag" ]]; then
|
|
[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *'[CI]'* ]] || exit 2
|
|
channel=dev
|
|
namespace=moshiro-dev
|
|
else
|
|
[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || exit 2
|
|
fi
|
|
[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
|
|
[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
|
|
echo "Zot credentials are required" >&2
|
|
exit 2
|
|
}
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
# Native packages and OCI tags use the same deterministic CI version.
|
|
source "$root/ci/version.sh"
|
|
version="$MOSHIRO_VERSION"
|
|
tag="$MOSHIRO_TAG"
|
|
|
|
gitea_base="${GITEA_BASE:-http://127.0.0.1:3100}"
|
|
gitea_base="${gitea_base%/}"
|
|
gitea_host="${gitea_base#https://}"
|
|
gitea_host="${gitea_host#http://}"
|
|
gitea_host="${gitea_host%%/*}"
|
|
gitea_host="${gitea_host%%:*}"
|
|
registry="${ZOT_REGISTRY:-registry.oeo.one}"
|
|
image_root="$registry/$namespace"
|
|
work="$root/.release/node-images/$channel"
|
|
netrc="$work/netrc"
|
|
buildah_home="/home/justme/woodpecker/buildah-home/node-images-$channel"
|
|
mkdir -p "$buildah_home"
|
|
exec 9> "$buildah_home/.lock"
|
|
flock -w 1800 9
|
|
source "$root/ci/buildah-env.sh"
|
|
moshiro_setup_buildah "$buildah_home"
|
|
mkdir -p "$work"
|
|
chmod 700 "$work"
|
|
printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
|
|
chmod 600 "$netrc"
|
|
export REGISTRY_AUTH_FILE="$work/zot-auth.json"
|
|
trap 'rm -rf "$work"' EXIT
|
|
|
|
logged_in=false
|
|
for attempt in 1 2 3 4; do
|
|
if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
|
|
logged_in=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" -lt 4 ]]; then
|
|
echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
|
|
sleep 3
|
|
fi
|
|
done
|
|
[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
|
|
|
|
build_arch_image() {
|
|
local component="$1" arch="$2" suffix="$3"
|
|
local filename="moshiro-$component-v$version-linux-$suffix.tar.gz"
|
|
local context="$work/$component-$arch"
|
|
local extracted="$work/extracted-$component-$arch"
|
|
local archive="$work/$filename"
|
|
local containerfile="$root/packaging/container/${component^}.Containerfile"
|
|
local image="$image_root/moshiro-$component"
|
|
local local_image="localhost/moshiro-$component:ci-$channel-$arch"
|
|
local runtime_base=mcr.microsoft.com/dotnet/runtime-deps:10.0
|
|
[[ "$suffix" != musl-* ]] || runtime_base=mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
|
|
|
|
curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
|
|
"$gitea_base/api/packages/justme/generic/moshiro-node/$version/$filename" -o "$archive"
|
|
mkdir -p "$context/app" "$context/config"
|
|
mkdir -p "$extracted"
|
|
tar -xzf "$archive" -C "$extracted"
|
|
install -m 0755 "$extracted/fleet-enroll" "$context/app/fleet-enroll"
|
|
install -m 0755 "$extracted/moshiro-$component" "$context/app/moshiro-$component"
|
|
for library in "$extracted"/lib*.so.*; do
|
|
[[ ! -f "$library" ]] || install -m 0644 "$library" "$context/app/"
|
|
done
|
|
: > "$context/config/.keep"
|
|
install -m 0755 "$root/packaging/container/entrypoint.sh" "$context/entrypoint.sh"
|
|
|
|
buildah bud --tls-verify=true --arch "$arch" \
|
|
--build-arg "APP_VERSION=$version" --build-arg "RUNTIME_BASE=$runtime_base" \
|
|
-f "$containerfile" -t "$local_image" "$context" >/dev/null
|
|
|
|
local pushed=false
|
|
for attempt in 1 2 3; do
|
|
if buildah push --tls-verify=true "$local_image" "docker://$image:$version-$arch" >/dev/null; then
|
|
pushed=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" -lt 3 ]]; then
|
|
echo "Zot push for $component/$arch attempt $attempt failed; retrying in 5 seconds" >&2
|
|
sleep 5
|
|
fi
|
|
done
|
|
[[ "$pushed" == true ]] || { echo "could not push $component/$arch image after 3 attempts" >&2; return 1; }
|
|
echo "pushed Zot image $image:$version-$arch"
|
|
}
|
|
|
|
publish_index() {
|
|
local component="$1" image="$image_root/moshiro-$component"
|
|
local manifest="localhost/moshiro-$component:$version-multiarch"
|
|
buildah manifest rm "$manifest" >/dev/null 2>&1 || true
|
|
buildah manifest create "$manifest" >/dev/null
|
|
buildah manifest add "$manifest" "docker://$image:$version-amd64" >/dev/null
|
|
buildah manifest add "$manifest" "docker://$image:$version-arm64" >/dev/null
|
|
buildah manifest push --all --format oci --digestfile "$work/$component.digest" "$manifest" "docker://$image:$version" >/dev/null
|
|
if [[ "$channel" == dev || "$version" != *-* ]]; then
|
|
buildah manifest push --all --format oci "$manifest" "docker://$image:latest" >/dev/null
|
|
fi
|
|
buildah manifest rm "$manifest" >/dev/null
|
|
echo "published multi-architecture index $image:$version"
|
|
if [[ "$channel" == dev || "$version" != *-* ]]; then
|
|
echo "published multi-architecture index $image:latest"
|
|
fi
|
|
}
|
|
|
|
for component in agent; do
|
|
build_arch_image "$component" amd64 amd64
|
|
build_arch_image "$component" arm64 musl-arm64
|
|
publish_index "$component"
|
|
# 发布清单：给多架构镜像的 digest 签名（私钥只在 CI 密钥里），放进镜像仓库（<仓库>-manifest:release），面板在线时再登记一份加速。
|
|
# 没有配置签名密钥（例如 fork）就只发镜像、不发清单。
|
|
if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
|
|
digest="$(cat "$work/$component.digest")"
|
|
bash "$root/ci/publish-release-offer.sh" "$component" "$image_root/moshiro-$component" "$digest" "$tag" "$channel" "$work/$component-release"
|
|
fi
|
|
done
|
|
|
|
bash "$root/ci/cleanup-build-cache.sh"
|