root
49 lines
2.2 KiB
Bash
Executable File
49 lines
2.2 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
source_root=${SOURCE_ROOT:?SOURCE_ROOT is required}
|
|
source_commit=${SOURCE_COMMIT:?SOURCE_COMMIT is required}
|
|
image_repository=${IMAGE_REPOSITORY:?IMAGE_REPOSITORY is required}
|
|
dockerfile=${DOCKERFILE:?DOCKERFILE is required}
|
|
build_network=${BUILD_NETWORK:?BUILD_NETWORK is required}
|
|
metadata_file=${BUILD_METADATA_FILE:?BUILD_METADATA_FILE is required}
|
|
result_file=${BUILD_RESULT_FILE:?BUILD_RESULT_FILE is required}
|
|
|
|
case "$source_commit" in
|
|
*[!0-9a-f]*|'') printf '%s\n' 'SOURCE_COMMIT must be a full lowercase Git SHA' >&2; exit 2 ;;
|
|
esac
|
|
[ "${#source_commit}" -eq 40 ] || { printf '%s\n' 'SOURCE_COMMIT must be 40 characters' >&2; exit 2; }
|
|
[ "$build_network" = host ] || { printf '%s\n' 'BUILD_NETWORK must be host' >&2; exit 2; }
|
|
case "$dockerfile" in
|
|
/*|*../*|*/..|..) printf '%s\n' 'DOCKERFILE must be a safe relative path' >&2; exit 2 ;;
|
|
esac
|
|
[ -f "$source_root/$dockerfile" ] || { printf '%s\n' 'Dockerfile is missing' >&2; exit 2; }
|
|
|
|
image_ref="$image_repository:$(printf '%s' "$source_commit" | cut -c1-12)"
|
|
rm -f "$metadata_file" "$result_file"
|
|
|
|
buildctl-daemonless.sh build \
|
|
--allow network.host \
|
|
--frontend dockerfile.v0 \
|
|
--local context="$source_root" \
|
|
--local dockerfile="$source_root" \
|
|
--opt "filename=$dockerfile" \
|
|
--opt "network=$build_network" \
|
|
--opt "build-arg:HTTP_PROXY=${HTTP_PROXY:-}" \
|
|
--opt "build-arg:HTTPS_PROXY=${HTTPS_PROXY:-}" \
|
|
--opt "build-arg:ALL_PROXY=${ALL_PROXY:-}" \
|
|
--opt "build-arg:NO_PROXY=${NO_PROXY:-}" \
|
|
--metadata-file "$metadata_file" \
|
|
--output "type=image,name=$image_ref,push=true,registry.insecure=true"
|
|
|
|
[ -s "$metadata_file" ] || { printf '%s\n' 'BuildKit metadata is missing' >&2; exit 2; }
|
|
digest=$(tr -d '\n' < "$metadata_file" | sed -n 's/.*"containerimage.digest"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
|
|
case "$digest" in
|
|
sha256:????????????????????????????????????????????????????????????????) ;;
|
|
*) printf '%s\n' 'BuildKit metadata digest is invalid' >&2; exit 2 ;;
|
|
esac
|
|
|
|
printf '{"ok":true,"phase":"image-build","status":"built","imageStatus":"built","sourceCommit":"%s","imageRef":"%s","digest":"%s","digestRef":"%s@%s","valuesPrinted":false}\n' \
|
|
"$source_commit" "$image_ref" "$digest" "$image_repository" "$digest" > "$result_file"
|
|
cat "$result_file"
|