Debian 13 runtime with restic 0.18.1 pinned outside the OS; restic assumptions re-proven; felhom-samba 1.2.0 (R-1105, R-972)

2026-10-16 20:33:57 +02:00
parent 29a3ce8cf2
commit fbcc3cf042
47 changed files with 706 additions and 48 deletions
@@ -18,6 +18,41 @@ ACTION="${2:-}"
 REGISTRY="gitea.dooplex.hu/admin"
 IMAGE="${REGISTRY}/felhom-samba"
 CTX="$(cd "$(dirname "$0")/../infra-images/samba" && pwd)"
+REPO_DIR="${FELHOM_REPO_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+
+# A VERSION NUMBER IS PUSHED ONCE (R-972, felhom-samba 1.2.0) — the same two checks build.sh makes for the
+# controller (v0.316.0/v0.316.4), because the box pulls an infra image by its tag and never again once it has it:
+# a second image under one number is a box that runs either and never learns which. Before any build:
+#   1. the tag must be ABSENT from the registry; a registry that cannot be asked is a refusal, not a pass;
+#   2. the tree must be clean and at origin/main — an image from an unpushed tree cannot be rebuilt.
+# Local builds (no --push) are untouched. Tested by scripts/test_samba_build_push_once.sh (a fake `docker`).
+if [[ "${ACTION}" == "--push" ]]; then
+    probe_rc=0
+    probe_out=$(docker manifest inspect "${IMAGE}:${VERSION}" 2>&1) || probe_rc=$?
+    if [[ ${probe_rc} -eq 0 ]]; then
+        echo "[ERROR] ${IMAGE}:${VERSION} already exists in the registry — bump the version." >&2
+        exit 1
+    fi
+    if ! grep -qiE 'no such manifest|manifest unknown|not found|does not exist|NAME_UNKNOWN|MANIFEST_UNKNOWN' <<<"${probe_out}"; then
+        echo "[ERROR] Could not establish whether ${IMAGE}:${VERSION} exists — refusing to build. The registry answered: ${probe_out}" >&2
+        exit 1
+    fi
+    echo "[INFO] ${VERSION} is not present in the registry — proceeding."
+    if ! git -C "${REPO_DIR}" rev-parse --git-dir >/dev/null 2>&1; then
+        echo "[ERROR] ${REPO_DIR} is not a git checkout — refusing to push a build whose source cannot be identified." >&2
+        exit 1
+    fi
+    if [[ -n "$(git -C "${REPO_DIR}" status --porcelain 2>/dev/null)" ]]; then
+        echo "[ERROR] ${REPO_DIR} has uncommitted changes — refusing to push a build from it." >&2
+        exit 1
+    fi
+    if [[ "$(git -C "${REPO_DIR}" rev-parse HEAD)" != "$(git -C "${REPO_DIR}" rev-parse origin/main 2>/dev/null)" ]]; then
+        echo "[ERROR] ${REPO_DIR} is not at origin/main — refusing to push." >&2
+        exit 1
+    fi
+    echo "[INFO] Source tree is clean and at origin/main."
+    CTX="${REPO_DIR}/controller/infra-images/samba"
+fi

 echo "[INFO] building ${IMAGE}:${VERSION}"
 echo "[INFO] context: ${CTX}"