tegwick
16ca97b277
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
37 lines
1.9 KiB
Bash
37 lines
1.9 KiB
Bash
#!/usr/bin/env bash
|
|
# Uses the enclosing Forge runner's existing registry login. No credential reads.
|
|
set -euo pipefail
|
|
revision=${1:?full source revision required}
|
|
mode=${2:-legacy}
|
|
context=${3:-.}
|
|
[[ "$revision" =~ ^[a-f0-9]{40}$ ]] || { echo 'full immutable source revision required' >&2; exit 2; }
|
|
[[ "$mode" == legacy || "$mode" == paired ]] || { echo 'unknown publication mode' >&2; exit 2; }
|
|
short=${revision:0:7}
|
|
registry=forgejo.coulomb.social
|
|
legacy="$registry/coulomb/flex-auth"
|
|
renamed="$registry/coulomb/access-engine"
|
|
docker build -f "$context/Containerfile" --label "org.opencontainers.image.revision=$revision" -t "$legacy:main-$short" "$context"
|
|
images=("$legacy")
|
|
if [[ "$mode" == paired ]]; then
|
|
docker tag "$legacy:main-$short" "$renamed:main-$short"
|
|
images+=("$renamed")
|
|
fi
|
|
for image in "${images[@]}"; do
|
|
docker tag "$image:main-$short" "$image:latest"
|
|
docker push "$image:main-$short"
|
|
docker push "$image:latest"
|
|
done
|
|
# Pull each published immutable tag through the runner's existing registry login.
|
|
# RepoDigests then records the registry's top-level digest, including OCI indexes
|
|
# and attestations; comparing a local image/config ID would not prove publication.
|
|
digests=()
|
|
for image in "${images[@]}"; do
|
|
docker pull "$image:main-$short"
|
|
raw=$(docker image inspect --format '{{json .RepoDigests}}' "$image:main-$short")
|
|
digest=$(printf '%s' "$raw" | python3 -c 'import json,re,sys; x=json.load(sys.stdin); assert isinstance(x,list); matches=[v.removeprefix(sys.argv[1]+"@") for v in x if isinstance(v,str) and v.startswith(sys.argv[1]+"@")]; assert len(matches)==1 and re.fullmatch(r"sha256:[a-f0-9]{64}",matches[0]); print(matches[0])' "$image")
|
|
digests+=("$digest")
|
|
done
|
|
if [[ "$mode" == paired && "${digests[0]}" != "${digests[1]}" ]]; then
|
|
echo 'published registry manifest digests differ' >&2; exit 1
|
|
fi
|
|
printf 'publication mode=%s revision=%s manifest_digest=%s verified_repositories=%s\n' "$mode" "$revision" "${digests[0]}" "${#images[@]}"
|