69 lines
3.5 KiB
Bash
Executable File
69 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# felhom-samba — infra image build+push helper (R-7 slice 1).
|
|
# Run on the build server (192.168.0.180). Mirrors build.sh usage.
|
|
#
|
|
# ./build-samba-image.sh 1.0.0 # build local only
|
|
# ./build-samba-image.sh 1.0.0 --push # build + push to Gitea registry
|
|
#
|
|
# NEVER tags :latest (a floating tag breaks reproducible pins). The controller pins the
|
|
# exact tag in the generated compose. After --push, verify ANONYMOUS pull works (the guest
|
|
# pulls infra images without creds — same as the controller self-update path).
|
|
# =============================================================================
|
|
set -euo pipefail
|
|
|
|
VERSION="${1:?usage: build-samba-image.sh <version> [--push]}"
|
|
ACTION="${2:-}"
|
|
|
|
REGISTRY="gitea.dooplex.hu/admin"
|
|
IMAGE="${REGISTRY}/felhom-samba"
|
|
CTX="$(cd "$(dirname "$0")/../infra-images/samba" && pwd)"
|
|
REPO_DIR="${FELHOM_REPO_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
|
|
|
|
# A VERSION NUMBER IS PUSHED ONCE (R-972, felhom-samba 1.2.0) — the same two checks build.sh makes for the
|
|
# controller (v0.316.0/v0.316.4), because the box pulls an infra image by its tag and never again once it has it:
|
|
# a second image under one number is a box that runs either and never learns which. Before any build:
|
|
# 1. the tag must be ABSENT from the registry; a registry that cannot be asked is a refusal, not a pass;
|
|
# 2. the tree must be clean and at origin/main — an image from an unpushed tree cannot be rebuilt.
|
|
# Local builds (no --push) are untouched. Tested by scripts/test_samba_build_push_once.sh (a fake `docker`).
|
|
if [[ "${ACTION}" == "--push" ]]; then
|
|
probe_rc=0
|
|
probe_out=$(docker manifest inspect "${IMAGE}:${VERSION}" 2>&1) || probe_rc=$?
|
|
if [[ ${probe_rc} -eq 0 ]]; then
|
|
echo "[ERROR] ${IMAGE}:${VERSION} already exists in the registry — bump the version." >&2
|
|
exit 1
|
|
fi
|
|
if ! grep -qiE 'no such manifest|manifest unknown|not found|does not exist|NAME_UNKNOWN|MANIFEST_UNKNOWN' <<<"${probe_out}"; then
|
|
echo "[ERROR] Could not establish whether ${IMAGE}:${VERSION} exists — refusing to build. The registry answered: ${probe_out}" >&2
|
|
exit 1
|
|
fi
|
|
echo "[INFO] ${VERSION} is not present in the registry — proceeding."
|
|
if ! git -C "${REPO_DIR}" rev-parse --git-dir >/dev/null 2>&1; then
|
|
echo "[ERROR] ${REPO_DIR} is not a git checkout — refusing to push a build whose source cannot be identified." >&2
|
|
exit 1
|
|
fi
|
|
if [[ -n "$(git -C "${REPO_DIR}" status --porcelain 2>/dev/null)" ]]; then
|
|
echo "[ERROR] ${REPO_DIR} has uncommitted changes — refusing to push a build from it." >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$(git -C "${REPO_DIR}" rev-parse HEAD)" != "$(git -C "${REPO_DIR}" rev-parse origin/main 2>/dev/null)" ]]; then
|
|
echo "[ERROR] ${REPO_DIR} is not at origin/main — refusing to push." >&2
|
|
exit 1
|
|
fi
|
|
echo "[INFO] Source tree is clean and at origin/main."
|
|
CTX="${REPO_DIR}/controller/infra-images/samba"
|
|
fi
|
|
|
|
echo "[INFO] building ${IMAGE}:${VERSION}"
|
|
echo "[INFO] context: ${CTX}"
|
|
docker build -t "${IMAGE}:${VERSION}" "${CTX}"
|
|
|
|
if [[ "${ACTION}" == "--push" ]]; then
|
|
echo "[INFO] pushing ${IMAGE}:${VERSION}"
|
|
docker push "${IMAGE}:${VERSION}"
|
|
echo "[INFO] pushed. Verify anonymous pull (guest has no registry creds):"
|
|
echo " docker logout ${REGISTRY%%/*} 2>/dev/null; docker pull ${IMAGE}:${VERSION}"
|
|
else
|
|
echo "[INFO] local build only. To push: ./build-samba-image.sh ${VERSION} --push"
|
|
fi
|