41 lines
2.1 KiB
Bash
41 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
: "${REGISTRY_SERVER:?Missing Gitea server URL}"
|
|
: "${REGISTRY_REPOSITORY:?Missing owner/repository}"
|
|
: "${REGISTRY_USER:?Configure CONTAINER_REGISTRY_USER}"
|
|
: "${REGISTRY_TOKEN:?Configure CONTAINER_REGISTRY_TOKEN with package write access}"
|
|
sha="$(git rev-parse HEAD)"
|
|
[[ "$sha" =~ ^[0-9a-f]{40}$ ]] || exit 1
|
|
registry="${REGISTRY_SERVER#https://}"
|
|
registry="${registry%/}"
|
|
[[ "$REGISTRY_SERVER" = https://* && "$registry" != */* ]] || { echo "Registry must use HTTPS at the Gitea server root" >&2; exit 1; }
|
|
repository="${REGISTRY_REPOSITORY,,}"
|
|
[[ "$repository" =~ ^[a-z0-9._-]+/[a-z0-9._-]+$ ]] || exit 1
|
|
image="$registry/$repository:$sha"
|
|
# Isolate credentials from the self-hosted runner's normal Docker configuration.
|
|
export DOCKER_CONFIG
|
|
DOCKER_CONFIG="$(mktemp -d)"
|
|
context="$(mktemp -d)"
|
|
trap 'rm -rf -- "$DOCKER_CONFIG" "$context"' EXIT
|
|
# Build only the committed source, never untracked files from a shared runner.
|
|
git archive HEAD | tar -x -C "$context"
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login "$registry" --username "$REGISTRY_USER" --password-stdin
|
|
unset REGISTRY_TOKEN
|
|
# On the shared runner, publish the exact image already verified by deployment.
|
|
local_image="epicnext-cms:$sha"
|
|
local_revision="$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$local_image" 2>/dev/null || true)"
|
|
local_id="$(docker image inspect --format '{{.Id}}' "$local_image" 2>/dev/null || true)"
|
|
verified_id="$(docker image inspect --format '{{.Id}}' "epicnext-cms:verified-$sha" 2>/dev/null || true)"
|
|
if [[ "$local_revision" = "$sha" && -n "$local_id" && "$local_id" = "$verified_id" ]]; then
|
|
docker tag "$verified_id" "$image"
|
|
echo "Reusing verified release image $local_image"
|
|
else
|
|
docker build --network=host --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" "$context"
|
|
fi
|
|
docker build --network=host --target migrations -t "$image-migrations" "$context"
|
|
node scripts/verify-portable-image.mjs "$image" "$sha"
|
|
# Publish only after the same application image passed both runtime configurations.
|
|
docker push "$image-migrations"
|
|
docker push "$image"
|
|
echo "Published application and migrations: $image"
|