ci-scripts/entrypoint.sh

#!/usr/bin/env bash
# shellcheck disable=SC2250,SC2292,SC2310,SC2312
# (style-only: brace-optional var refs, [[ ]] preference, set -e-in-||
# advisories — none affect correctness here; the explicit run_status/
# attic_status capture pattern is intentional, not an oversight.)
# ci-fleet-publish entrypoint (oleks/ci-scripts#14, #15).
#
# Woodpecker plugin entrypoint: reads PLUGIN_* settings (Woodpecker maps a
# step's `settings:` map onto PLUGIN_<UPPER_KEY> env vars) and PLUGIN_FLOW
# selects the behavior:
#
#   publish          - (default) run PLUGIN_RUN after the shared setup
#                       (arch banner, resolv.conf/nix.conf shims, attic
#                       cache) — the single-step shape from the wiki's thin
#                       pipeline contract.
#   buildx-build      - buildx build+push a single per-arch tag for the
#                       current node's arch (one Woodpecker matrix leg per
#                       arch) — half of the "buildx-multiarch" quartet shape.
#   buildx-manifest   - probe the registry for which per-arch tags actually
#                       landed and create a manifest from whatever exists
#                       (oleks/ci-scripts#9: fail only if NONE landed, never
#                       skip on partial success) — the other half.
#
# Deviation from Spec/Fleet Publish Plugin System (oleks/ci-scripts#15):
# the spec names one flow value `buildx-multiarch` for the whole quartet
# shape, but a single flow value can't distinguish "build my arch's tag"
# from "consolidate the manifest" — those are two different Woodpecker
# steps (build matrix + a `depends_on: build, runs_on: [success, failure]`
# manifest step) using the SAME plugin image. Split into `buildx-build` /
# `buildx-manifest` instead; wiki updated to match.
#
# Version resolution for buildx-build/buildx-manifest (oleks/ci-scripts#21,
# see resolve_version() below): defaults to the raw CI_COMMIT_TAG (or an
# explicit `version:` setting, or "latest") — unchanged from before. A repo
# whose own build script normalizes tags (strips a leading "v" and a
# trailing "-<build-number>") can opt in with `tag_strip_v: "true"` to
# reproduce that exactly; default is off.
#
# See wiki Spec/Modern-CI-Target and Spec/Fleet Publish Plugin System.
set -euo pipefail

echo "▸ arch=$(uname -m)"

: "${PLUGIN_FLOW:=publish}"

# --- resolv.conf shim (s390x cross-build DNS fix, oleks/ci-scripts#4) ---
if [ -n "${PLUGIN_NAMESERVER:-}" ]; then
	echo "nameserver ${PLUGIN_NAMESERVER}" >/etc/resolv.conf
	echo "options ndots:1" >>/etc/resolv.conf
fi

# --- nix.conf shims ---
if [ "${PLUGIN_MAX_JOBS:-}" = "true" ]; then
	echo "max-jobs = 1" >>/etc/nix/nix.conf
fi
if [ -n "${PLUGIN_CORES:-}" ]; then
	echo "cores = ${PLUGIN_CORES}" >>/etc/nix/nix.conf
fi
echo "sandbox = false" >>/etc/nix/nix.conf

normalize_arch() {
	case "$1" in
	x86_64) echo "amd64" ;;
	aarch64) echo "arm64" ;;
	*) echo "$1" ;;
	esac
}

render_tag() {
	# render_tag SCHEME VERSION ARCH
	local scheme="$1" version="$2" arch="$3"
	scheme="${scheme//\{version\}/$version}"
	scheme="${scheme//\{arch\}/$arch}"
	echo "$scheme"
}

resolve_version() {
	# resolve_version — the string substituted for {version} in tag_scheme,
	# used by both buildx_build_flow and buildx_manifest_flow so the two
	# stay in lockstep (oleks/ci-scripts#21).
	#
	# Precedence: an explicit `version:` setting (PLUGIN_VERSION) wins over
	# the tag the pipeline triggered on (CI_COMMIT_TAG), else "latest".
	# Nothing currently sets PLUGIN_VERSION (audited across every repo using
	# this plugin), so this is a no-op precedence change for every existing
	# consumer today.
	#
	# `tag_strip_v: "true"` (PLUGIN_TAG_STRIP_V) additionally strips a
	# leading "v" and a trailing "-<build-number>" suffix, e.g. "v0.22.7-4"
	# -> "0.22.7" — the normalization xonsh-image's (and csi-s3's) ci/local.sh
	# already does before tagging. Default is "false": preserves the raw
	# tag verbatim, which is what ci-scripts' own self-build (ci/local.sh,
	# this plugin's own v1.0.x tags) and every other current consumer of
	# this plugin already expect. Opt in per-repo via `tag_strip_v: "true"`
	# in `settings:` — do not flip the default.
	local version="${PLUGIN_VERSION:-${CI_COMMIT_TAG:-latest}}"
	if [ "${PLUGIN_TAG_STRIP_V:-false}" = "true" ]; then
		version="${version#v}"
		version="${version%-[0-9]*}"
	fi
	printf '%s' "$version"
}

# --- attic watch-store lifecycle: explicit non-masking shutdown, never `|| true` ---
ATTIC_PID=""

attic_start() {
	if [ "${PLUGIN_CACHE:-true}" != "true" ] || [ -z "${ATTIC_TOKEN:-}" ]; then
		return 0
	fi
	local server="${PLUGIN_ATTIC_SERVER:-https://nix-cache-upload.oleks.space}"
	local cache="${PLUGIN_ATTIC_CACHE:-attic-infra-cache-k3s-1}"
	attic login ci "$server" "$ATTIC_TOKEN"
	attic watch-store "$cache" &
	ATTIC_PID=$!
	sleep 2
	echo "▸ attic watch-store started for ${cache} (pid ${ATTIC_PID})"
}

attic_stop() {
	# attic_stop RUN_STATUS — folds a non-zero shutdown into the exit code
	# only if the run itself succeeded (a failing run's status always wins).
	local run_status="$1"
	if [ -z "$ATTIC_PID" ]; then
		return 0
	fi
	if ! kill "$ATTIC_PID" 2>/dev/null; then
		echo "▸ attic watch-store already exited before shutdown" >&2
		return 0
	fi
	if wait "$ATTIC_PID"; then
		echo "▸ attic watch-store exited cleanly after shutdown signal"
		return 0
	fi
	local status=$?
	if [ "$status" -eq 143 ] || [ "$status" -eq 137 ]; then
		echo "▸ attic watch-store terminated by shutdown signal (exit ${status}, expected)"
		return 0
	fi
	echo "▸ attic watch-store exited non-zero (${status}) after shutdown signal" >&2
	if [ "$run_status" -eq 0 ]; then
		return "$status"
	fi
	return 0
}

publish_flow() {
	: "${PLUGIN_RUN:?PLUGIN_RUN is required when PLUGIN_FLOW=publish}"
	# Delegate netrc/redis setup to nixos-ci-entrypoint, but WITHOUT
	# ATTIC_TOKEN: this script already owns the attic lifecycle above, so
	# nixos-ci-entrypoint must not start a second watch-store.
	env -u ATTIC_TOKEN nixos-ci-entrypoint bash -lc "$PLUGIN_RUN"
}

buildx_build_flow() {
	: "${PLUGIN_IMAGE_NAME:?PLUGIN_IMAGE_NAME is required for buildx-build flow}"
	local arch
	arch=$(normalize_arch "$(uname -m)")
	# Note: default assigned in a separate statement, not
	# ${PLUGIN_TAG_SCHEME:-{version}-{arch}} — bash's brace-matching for the
	# default word gets confused by literal `{...}` braces in the fallback
	# and silently corrupts the rendered tag.
	local tag_scheme="{version}-{arch}"
	if [ -n "${PLUGIN_TAG_SCHEME:-}" ]; then
		tag_scheme="${PLUGIN_TAG_SCHEME}"
	fi
	local version
	version=$(resolve_version)
	local tag
	tag=$(render_tag "$tag_scheme" "$version" "$arch")
	local context="${PLUGIN_CONTEXT:-.}"
	echo "▸ building ${PLUGIN_IMAGE_NAME}:${tag} for linux/${arch} (context ${context})"
	# --provenance=false --sbom=false: BuildKit >=0.11 attaches attestations
	# by default, which forces even a single-platform build to push as an
	# OCI manifest LIST (index) rather than a plain image manifest. That
	# breaks `docker manifest create` downstream (buildx-manifest flow),
	# which refuses to add a manifest-list as a member. Disable both so the
	# per-arch tag is a plain image manifest.
	docker buildx build --push --provenance=false --sbom=false --platform "linux/${arch}" -t "${PLUGIN_IMAGE_NAME}:${tag}" "${context}"
}

buildx_manifest_flow() {
	: "${PLUGIN_IMAGE_NAME:?PLUGIN_IMAGE_NAME is required for buildx-manifest flow}"
	: "${PLUGIN_PLATFORMS:?PLUGIN_PLATFORMS is required for buildx-manifest flow (comma-separated arches to probe)}"
	local tag_scheme="{version}-{arch}"
	if [ -n "${PLUGIN_TAG_SCHEME:-}" ]; then
		tag_scheme="${PLUGIN_TAG_SCHEME}"
	fi
	local version
	version=$(resolve_version)
	local dest_tags="${PLUGIN_DEST_TAGS:-${version},latest}"

	IFS=',' read -ra platforms <<<"$PLUGIN_PLATFORMS"
	local found=()
	local arch tag ref
	for arch in "${platforms[@]}"; do
		arch="$(echo "$arch" | xargs)"
		tag=$(render_tag "$tag_scheme" "$version" "$arch")
		ref="${PLUGIN_IMAGE_NAME}:${tag}"
		echo "▸ probing ${ref}"
		if DOCKER_CLI_EXPERIMENTAL=enabled docker manifest inspect "$ref" >/dev/null 2>&1; then
			echo "▸ found ${ref}"
			found+=("$ref")
		else
			echo "▸ missing ${ref} (oleks/ci-scripts#9: skipping this arch, not failing the manifest)"
		fi
	done

	if [ "${#found[@]}" -eq 0 ]; then
		echo "no per-arch tags landed for ${PLUGIN_IMAGE_NAME}:${version}; failing manifest step" >&2
		return 1
	fi

	local dests=()
	IFS=',' read -ra dests <<<"$dest_tags"
	local dest dest_ref
	for dest in "${dests[@]}"; do
		dest="$(echo "$dest" | xargs)"
		dest_ref="${PLUGIN_IMAGE_NAME}:${dest}"
		echo "▸ creating manifest ${dest_ref} from ${#found[@]}/${#platforms[@]} arches"
		docker manifest create "$dest_ref" "${found[@]}"
		docker manifest push "$dest_ref"
	done
}

attic_start

run_status=0
case "$PLUGIN_FLOW" in
publish)
	publish_flow || run_status=$?
	;;
buildx-build)
	buildx_build_flow || run_status=$?
	;;
buildx-manifest)
	buildx_manifest_flow || run_status=$?
	;;
*)
	echo "unknown PLUGIN_FLOW: ${PLUGIN_FLOW} (expected publish|buildx-build|buildx-manifest)" >&2
	run_status=1
	;;
esac

attic_status=0
attic_stop "$run_status" || attic_status=$?
if [ "$attic_status" -ne 0 ] && [ "$run_status" -eq 0 ]; then
	run_status="$attic_status"
fi

exit "$run_status"