justme
993dd5c41c
ci/woodpecker/push/main-amd64-build Pipeline was successful
Probes connect to the panel directly and get the agent list as desired state. CI signs the image digest of agent and probe releases, the panel forwards the manifest, and a host updater verifies it with a local public key, pulls by digest and rolls back when the new version is unhealthy.
95 lines
3.8 KiB
Bash
95 lines
3.8 KiB
Bash
#!/usr/bin/env bash
|
|
# Build and push one opt-in main Linux amd64 image to the dev repository in Zot.
|
|
set -euo pipefail
|
|
|
|
[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
|
|
echo "main amd64 builds require a main push with [CI] in the commit message" >&2
|
|
exit 2
|
|
}
|
|
|
|
component="${1:?usage: build-main-amd64.sh <backend|agent|probe>}"
|
|
case "$component" in
|
|
backend|agent|probe) ;;
|
|
*) echo "unsupported component: $component" >&2; exit 2 ;;
|
|
esac
|
|
[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
|
|
echo "Zot credentials are required" >&2
|
|
exit 2
|
|
}
|
|
[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || {
|
|
echo "CI_COMMIT_SHA must be a full commit SHA" >&2
|
|
exit 2
|
|
}
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
registry="${ZOT_REGISTRY:-registry.oeo.one}"
|
|
repository="$registry/monitor-dev/monitor-$component"
|
|
work="$root/.release/main-amd64-build"
|
|
base_home="/home/justme/woodpecker/buildah-home/main-amd64-build-$component"
|
|
short_sha="${CI_COMMIT_SHA:0:12}"
|
|
dev_tag="dev-$short_sha"
|
|
mkdir -p "$work" "$base_home"
|
|
|
|
if [[ "$component" == backend ]]; then
|
|
BUILDAH_HOME="$base_home" \
|
|
ZOT_REGISTRY="$registry" \
|
|
ZOT_IMAGE_REPOSITORY="$repository" \
|
|
IMAGE_TAGS="latest,$dev_tag" \
|
|
IMAGE_PUBLISH=true \
|
|
bash "$root/ci/release-linux.sh" amd64 backend
|
|
exit 0
|
|
fi
|
|
|
|
export HOME="$base_home"
|
|
export BUILDAH_HOME="$base_home"
|
|
export REGISTRY_AUTH_FILE="$work/$component-auth.json"
|
|
context="$work/$component"
|
|
local_image="localhost/monitor-$component:main-amd64-check"
|
|
|
|
python3 "$root/ci/stage-node-image.py" "$component" "$context"
|
|
buildah bud --layers --network host --tls-verify=true --arch amd64 \
|
|
--build-arg APP_VERSION=main \
|
|
-f "$context/Containerfile" \
|
|
-t "$local_image" "$context"
|
|
|
|
logged_in=false
|
|
for attempt in 1 2 3 4; do
|
|
if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
|
|
logged_in=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" -lt 4 ]]; then
|
|
echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
|
|
sleep 3
|
|
fi
|
|
done
|
|
[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
|
|
|
|
for tag in latest "$dev_tag"; do
|
|
pushed=false
|
|
for attempt in 1 2 3; do
|
|
if buildah push --tls-verify=true --digestfile "$work/$component.digest" "$local_image" "docker://$repository:$tag"; then
|
|
pushed=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" -lt 3 ]]; then
|
|
echo "Zot push for $component:$tag attempt $attempt failed; retrying in 5 seconds" >&2
|
|
sleep 5
|
|
fi
|
|
done
|
|
[[ "$pushed" == true ]] || { echo "could not push $repository:$tag after 3 attempts" >&2; exit 1; }
|
|
echo "pushed development image $repository:$tag"
|
|
done
|
|
|
|
# 发布清单：给镜像的 digest 签名（私钥只在 CI 密钥里），再登记到面板；面板把它原样转给在线的节点，节点宿主机上的更新器用本机的公钥验签后才会更新。
|
|
# 没有配置签名密钥（例如 fork）就只构建镜像、不发清单。
|
|
if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
|
|
digest="$(cat "$work/$component.digest")"
|
|
release_dir="$work/$component-release"
|
|
bash "$root/ci/release-manifest.sh" "$component" "$repository" "$digest" "$dev_tag" dev "$release_dir"
|
|
if [[ -n "${RELEASE_API_URL:-}" && -n "${RELEASE_API_TOKEN:-}" ]]; then
|
|
python3 -c 'import json,sys; print(json.dumps({"manifest": open(sys.argv[1]).read(), "signature": open(sys.argv[2]).read()}))' "$release_dir/manifest.json" "$release_dir/manifest.sig" | curl --fail-with-body --silent --show-error --retry 3 -X POST "${RELEASE_API_URL%/}/api/admin/releases" -H "Authorization: Bearer $RELEASE_API_TOKEN" -H 'Content-Type: application/json' --data-binary @- >/dev/null
|
|
echo "registered the signed $component release with the panel"
|
|
fi
|
|
fi
|