Denozordec
9fa6269174
quality / changes (push) Successful in 7s
quality / commitlint (push) Skipped
quality / openapi (push) Successful in 30s
quality / web (push) Successful in 1m3s
quality / api (push) Successful in 1m15s
quality / linux-agent-smoke (push) Failing after 27s
quality / docker-check (push) Failing after 2m28s
CD / quality (push) Failing after 5m52s
CD / publish (push) Skipped
Implement reliable agent apply, telemetry v2, analytics retention, guarded rollouts, enrollment, labels and webhooks. Improve ReUI frontend data safety and bounded list loading, and add Docker smoke, recovery and resource checks. Document local verification and pending native acceptance.
41 lines
2.0 KiB
Bash
41 lines
2.0 KiB
Bash
#!/usr/bin/env sh
|
|
# Resolve upstream before mirroring; never reuse a stale mutable mirror silently.
|
|
set -eu
|
|
REGISTRY="${REGISTRY:?REGISTRY required (git.shx.one/<owner>)}"
|
|
SOURCE="${BASE_NODE_SOURCE:-docker.io/library/node:22-alpine}"
|
|
PLATFORM="${MIRROR_PLATFORM:-linux/amd64}"
|
|
resolve_digest() {
|
|
digest="$(docker buildx imagetools inspect "$1" | awk '/^Digest:/ {print $2; exit}')"
|
|
printf '%s\n' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$' || { echo "Cannot resolve verified digest: $1" >&2; return 1; }
|
|
printf '%s' "$digest"
|
|
}
|
|
source_digest="$(resolve_digest "$SOURCE")"
|
|
source_repo="${SOURCE%@*}"
|
|
# Tags may remain before @; repo:tag@digest is a valid immutable reference.
|
|
source_ref="$source_repo@$source_digest"
|
|
suffix="$(printf '%s' "${source_digest#sha256:}" | cut -c1-16)"
|
|
destination="$REGISTRY/evofw-buildcache:base-node-22-alpine-$suffix"
|
|
if ! docker buildx imagetools inspect "$destination" >/dev/null 2>&1; then
|
|
attempt=0
|
|
until docker buildx imagetools create --platform "$PLATFORM" --tag "$destination" "$source_ref"; do
|
|
attempt=$((attempt + 1))
|
|
[ "$attempt" -lt 4 ] || exit 1
|
|
sleep 30
|
|
done
|
|
fi
|
|
mirror_digest="$(resolve_digest "$destination")"
|
|
# Existing tags are untrusted: compare the selected platform descriptor against
|
|
# the immutable upstream index, even when no copy was necessary this run.
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
docker buildx imagetools inspect --raw "$source_ref" >"$tmp/source.json"
|
|
docker buildx imagetools inspect --raw "$destination@$mirror_digest" >"$tmp/mirror.json"
|
|
source_platform="$(node scripts/ci/manifest-platform.mjs "$tmp/source.json" "$source_digest" "$PLATFORM")"
|
|
mirror_platform="$(node scripts/ci/manifest-platform.mjs "$tmp/mirror.json" "$mirror_digest" "$PLATFORM")"
|
|
[ "$source_platform" = "$mirror_platform" ] || { echo 'Mirror platform digest differs from upstream; refusing existing tag' >&2; exit 1; }
|
|
reference="$destination@$mirror_digest"
|
|
printf 'BASE_NODE=%s\n' "$reference"
|
|
if [ -n "${MIRROR_ENV_FILE:-}" ]; then
|
|
printf 'BASE_NODE=%s\n' "$reference" >"$MIRROR_ENV_FILE"
|
|
fi
|