tegwick
84c78e072c
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
51 lines
2.5 KiB
Bash
51 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
|
# Uses the enclosing Forge runner's existing registry login. No credential reads.
|
|
set -euo pipefail
|
|
revision=${1:?full source revision required}
|
|
mode=${2:-legacy}
|
|
context=${3:-.}
|
|
[[ "$revision" =~ ^[a-f0-9]{40}$ ]] || { echo 'full immutable source revision required' >&2; exit 2; }
|
|
[[ "$mode" == legacy || "$mode" == paired ]] || { echo 'unknown publication mode' >&2; exit 2; }
|
|
short=${revision:0:7}
|
|
registry=forgejo.coulomb.social
|
|
legacy="$registry/coulomb/flex-auth"
|
|
renamed="$registry/coulomb/access-engine"
|
|
docker build -f "$context/Containerfile" --label "org.opencontainers.image.revision=$revision" -t "$legacy:main-$short" "$context"
|
|
images=("$legacy")
|
|
if [[ "$mode" == paired ]]; then
|
|
docker tag "$legacy:main-$short" "$renamed:main-$short"
|
|
images+=("$renamed")
|
|
fi
|
|
for image in "${images[@]}"; do
|
|
docker tag "$image:main-$short" "$image:latest"
|
|
docker push "$image:main-$short"
|
|
docker push "$image:latest"
|
|
done
|
|
# Pull each published immutable tag through the runner's existing registry login.
|
|
# RepoDigests then records the registry's top-level digest, including OCI indexes
|
|
# and attestations; comparing a local image/config ID would not prove publication.
|
|
digests=()
|
|
for image in "${images[@]}"; do
|
|
docker pull "$image:main-$short"
|
|
# The existing container-build runner supplies Bash and Docker, not Python.
|
|
# Capture inspect first so command failure is not hidden by process substitution.
|
|
raw=$(docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$image:main-$short")
|
|
digest=""
|
|
matches=0
|
|
while IFS= read -r reference; do
|
|
if [[ "$reference" == "$image@"* ]]; then
|
|
candidate=${reference#"$image@"}
|
|
[[ "$candidate" =~ ^sha256:[a-f0-9]{64}$ ]] || { echo 'invalid published registry manifest digest' >&2; exit 1; }
|
|
digest=$candidate
|
|
matches=$((matches + 1))
|
|
fi
|
|
done <<< "$raw"
|
|
[[ "$matches" == 1 ]] || { echo 'expected exactly one published repository digest' >&2; exit 1; }
|
|
actual_revision=$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$image:main-$short")
|
|
[[ "$actual_revision" == "$revision" ]] || { echo 'published image revision differs from exact source' >&2; exit 1; }
|
|
digests+=("$digest")
|
|
done
|
|
if [[ "$mode" == paired && "${digests[0]}" != "${digests[1]}" ]]; then
|
|
echo 'published registry manifest digests differ' >&2; exit 1
|
|
fi
|
|
printf 'publication mode=%s revision=%s manifest_digest=%s verified_repositories=%s\n' "$mode" "$revision" "${digests[0]}" "${#images[@]}"
|