justme
d449e50791
The versions page shows each node's update state with update buttons, API tokens get a release scope that can only register releases (used by CI), and the CI image and release builds now pass the tag, commit and build time.
96 lines
3.9 KiB
Bash
96 lines
3.9 KiB
Bash
#!/usr/bin/env bash
|
|
# Build and push one opt-in main Linux amd64 image to the dev repository in Zot.
|
|
set -euo pipefail
|
|
|
|
[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main && "${CI_COMMIT_MESSAGE:-}" == *"[CI]"* ]] || {
|
|
echo "main amd64 builds require a main push with [CI] in the commit message" >&2
|
|
exit 2
|
|
}
|
|
|
|
component="${1:?usage: build-main-amd64.sh <backend|agent|probe>}"
|
|
case "$component" in
|
|
backend|agent|probe) ;;
|
|
*) echo "unsupported component: $component" >&2; exit 2 ;;
|
|
esac
|
|
[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
|
|
echo "Zot credentials are required" >&2
|
|
exit 2
|
|
}
|
|
[[ "${CI_COMMIT_SHA:-}" =~ ^[0-9a-fA-F]{40}$ ]] || {
|
|
echo "CI_COMMIT_SHA must be a full commit SHA" >&2
|
|
exit 2
|
|
}
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
registry="${ZOT_REGISTRY:-registry.oeo.one}"
|
|
repository="$registry/monitor-dev/monitor-$component"
|
|
work="$root/.release/main-amd64-build"
|
|
base_home="/home/justme/woodpecker/buildah-home/main-amd64-build-$component"
|
|
short_sha="${CI_COMMIT_SHA:0:12}"
|
|
dev_tag="dev-$short_sha"
|
|
mkdir -p "$work" "$base_home"
|
|
|
|
if [[ "$component" == backend ]]; then
|
|
BUILDAH_HOME="$base_home" \
|
|
ZOT_REGISTRY="$registry" \
|
|
ZOT_IMAGE_REPOSITORY="$repository" \
|
|
IMAGE_TAGS="latest,$dev_tag" \
|
|
IMAGE_PUBLISH=true \
|
|
bash "$root/ci/release-linux.sh" amd64 backend
|
|
exit 0
|
|
fi
|
|
|
|
export HOME="$base_home"
|
|
export BUILDAH_HOME="$base_home"
|
|
export REGISTRY_AUTH_FILE="$work/$component-auth.json"
|
|
context="$work/$component"
|
|
local_image="localhost/monitor-$component:main-amd64-check"
|
|
|
|
python3 "$root/ci/stage-node-image.py" "$component" "$context"
|
|
buildah bud --layers --network host --tls-verify=true --arch amd64 \
|
|
--build-arg APP_VERSION=main \
|
|
--build-arg "MONITOR_TAG=$dev_tag" --build-arg "MONITOR_COMMIT=${CI_COMMIT_SHA:0:10}" --build-arg "MONITOR_BUILT_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
|
-f "$context/Containerfile" \
|
|
-t "$local_image" "$context"
|
|
|
|
logged_in=false
|
|
for attempt in 1 2 3 4; do
|
|
if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
|
|
logged_in=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" -lt 4 ]]; then
|
|
echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
|
|
sleep 3
|
|
fi
|
|
done
|
|
[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
|
|
|
|
for tag in latest "$dev_tag"; do
|
|
pushed=false
|
|
for attempt in 1 2 3; do
|
|
if buildah push --tls-verify=true --digestfile "$work/$component.digest" "$local_image" "docker://$repository:$tag"; then
|
|
pushed=true
|
|
break
|
|
fi
|
|
if [[ "$attempt" -lt 3 ]]; then
|
|
echo "Zot push for $component:$tag attempt $attempt failed; retrying in 5 seconds" >&2
|
|
sleep 5
|
|
fi
|
|
done
|
|
[[ "$pushed" == true ]] || { echo "could not push $repository:$tag after 3 attempts" >&2; exit 1; }
|
|
echo "pushed development image $repository:$tag"
|
|
done
|
|
|
|
# 发布清单：给镜像的 digest 签名（私钥只在 CI 密钥里），再登记到面板；面板把它原样转给在线的节点，节点宿主机上的更新器用本机的公钥验签后才会更新。
|
|
# 没有配置签名密钥（例如 fork）就只构建镜像、不发清单。
|
|
if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
|
|
digest="$(cat "$work/$component.digest")"
|
|
release_dir="$work/$component-release"
|
|
bash "$root/ci/release-manifest.sh" "$component" "$repository" "$digest" "$dev_tag" dev "$release_dir"
|
|
if [[ -n "${RELEASE_API_URL:-}" && -n "${RELEASE_API_TOKEN:-}" ]]; then
|
|
python3 -c 'import json,sys; print(json.dumps({"manifest": open(sys.argv[1]).read(), "signature": open(sys.argv[2]).read()}))' "$release_dir/manifest.json" "$release_dir/manifest.sig" | curl --fail-with-body --silent --show-error --retry 3 -X POST "${RELEASE_API_URL%/}/api/admin/releases" -H "Authorization: Bearer $RELEASE_API_TOKEN" -H 'Content-Type: application/json' --data-binary @- >/dev/null
|
|
echo "registered the signed $component release with the panel"
|
|
fi
|
|
fi
|