From f41a0465d28559858e99f00f47602af2c247c58a Mon Sep 17 00:00:00 2001 From: bigbes Date: Wed, 5 Aug 2026 06:39:28 +0300 Subject: [PATCH] ci: commit the apk build, packaging and mirror-trigger files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These three were written but never committed, so the whole publishing chain was dead from its first link: with no .build.yml on sourcecraft there is none on the git.srht.bigb.es mirror either, so the push hook has no manifest to submit, no build ever ran, and compare.sr.ht has never appeared in the apk index at repo.bigb.es — which today holds spec.sr.ht alone. The code itself was mirroring fine, which is what made this hard to see: the sourcehut side sits on the current commit, so everything looks configured until you ask git which of these files it actually knows about. .sourcecraft/webhooks.yaml is in the same state and has the same consequence one level up: the gitsync webhook was never registered, so the mirror has been riding its hourly safety-net poll rather than updating on push. The build secret apk-ci-s3 the publish task needs now exists on the account, so nothing else blocks the first build. --- .build.yml | 65 ++++++++++++++++++++++++++++++++++++++ .sourcecraft/webhooks.yaml | 24 ++++++++++++++ APKBUILD | 39 +++++++++++++++++++++++ 3 files changed, 128 insertions(+) create mode 100644 .build.yml create mode 100644 .sourcecraft/webhooks.yaml create mode 100644 APKBUILD diff --git a/.build.yml b/.build.yml new file mode 100644 index 0000000000000000000000000000000000000000..35fd8e3488d47211e4706e0041c1063b47ceed18 --- /dev/null +++ b/.build.yml @@ -0,0 +1,65 @@ +image: alpine/edge +packages: + - abuild + - go + - git + - rclone +secrets: + # File secret `apk-ci-s3`, installed at ~/.apk-ci.env, containing + # APK_CI_S3_ACCESS_KEY / APK_CI_S3_SECRET_KEY for the Garage `repo` bucket. + - apk-ci-s3 +sources: + - https://git.srht.bigb.es/~bigbes/sr-ht-compare +environment: + REPO: sr-ht-compare + APK_REPO: alpine/v3.22/bigbes/x86_64 + S3_BUCKET: repo + S3_ENDPOINT: https://s3.bigb.es +submitter: + git.sr.ht: + allow-refs: + - refs/heads/master +tasks: + - keygen: | + # abuild insists on signing what it builds, but this key is deliberately + # throwaway: generated per build, dies with the VM, trusted by nothing. + # Clients verify against the index instead, which is rebuilt and signed on + # phoebe by the garage stack's apk-mirror service — it indexes this repo + # with --allow-untrusted precisely because of this. + # + # -i installs the public half into /etc/apk/keys. Without it abuild's own + # final "update the local repository index" step dies with UNTRUSTED + # signature, after having built the package perfectly well. + SUDO=sudo abuild-keygen -a -n -i -q + - version: | + cd "$REPO" + ver="0.0.$(git rev-list --count HEAD)" + sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD + echo "export PKGVER=$ver" >> ~/.buildenv + echo "building $ver" + - build: | + cd "$REPO" + # -d: makedepends are already installed via `packages:` above, so skip + # abuild's own dependency resolution (which would want to sudo apk add). + REPODEST=$HOME/packages abuild -d + find "$HOME/packages" -name '*.apk' + - publish: | + set +x # never echo the S3 credentials into the build log + . ~/.apk-ci.env + export RCLONE_CONFIG_GARAGE_TYPE=s3 + export RCLONE_CONFIG_GARAGE_PROVIDER=Other + export RCLONE_CONFIG_GARAGE_ENDPOINT="$S3_ENDPOINT" + export RCLONE_CONFIG_GARAGE_REGION=garage + export RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE=true + export RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID="$APK_CI_S3_ACCESS_KEY" + export RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY="$APK_CI_S3_SECRET_KEY" + set -x + # Upload only; never delete. Old versions stay so a pinned deployment can + # always be rebuilt — the same reason the upstream mirror is append-only. + # abuild nests output under $REPODEST///, so flatten by + # uploading each file to a fixed prefix rather than mirroring the tree. + find "$HOME/packages" -name '*.apk' -print | while read -r f; do + rclone copyto "$f" "garage:$S3_BUCKET/$APK_REPO/$(basename "$f")" + echo "uploaded $(basename "$f")" + done + echo "published; apk-mirror on phoebe re-indexes within 15 minutes" diff --git a/.sourcecraft/webhooks.yaml b/.sourcecraft/webhooks.yaml new file mode 100644 index 0000000000000000000000000000000000000000..e7fca1b842b72199ae850ac0ae668ae722f4ea6f --- /dev/null +++ b/.sourcecraft/webhooks.yaml @@ -0,0 +1,24 @@ +# Notifies the lab's gitsync service that this repo has moved, so the mirror on +# our self-hosted sourcehut updates within seconds instead of waiting for its +# hourly safety-net poll. That matters beyond the mirror itself: builds.sr.ht CI +# (see .build.yml) only fires once the commit lands on the sourcehut side, so +# this webhook is what makes push -> apk build feel immediate. +# +# The receiver verifies the HMAC-SHA256 in X-Src-Signature over the request +# body. The signing key is generated by SourceCraft, is not part of this file, +# and is read once from Автоматизации -> Вебхуки into the gitsync stack's .env. +# +# The slug is unique per repository, but the receiver serves all three repos and +# maps slug -> signing key, so it must be unique ACROSS them too — hence the +# suffix rather than a plain "gitsync". +webhooks: + hooks: + - slug: gitsync-compare + name: "gitsync mirror trigger" + description: "Triggers the phoebe gitsync service to mirror sr-ht-compare to git.srht.bigb.es" + url: "https://gitsync.bigb.es/hook" + ssl_verification: true + active: true + on: + push: + - hooks: ["gitsync-compare"] diff --git a/APKBUILD b/APKBUILD new file mode 100644 index 0000000000000000000000000000000000000000..80de5cd87bffb6de40b25cea1a931211d8a650f2 --- /dev/null +++ b/APKBUILD @@ -0,0 +1,39 @@ +# Maintainer: bigbes +# +# Built by builds.sr.ht (.build.yml) and published to our own apk repo at +# repo.bigb.es/alpine/v3.22/bigbes. The srht deployment installs it from there +# instead of cloning and compiling this repo inside its Dockerfile. +# +# pkgver is rewritten by CI to 0.0. before abuild runs — a +# monotonic, unique-per-commit version that the deployment can pin. The literal +# below is only what a local `abuild` would use. +pkgname=compare.sr.ht +pkgver=0.0.0 +pkgrel=0 +pkgdesc="Stateless diff/compare viewer for a sourcehut instance" +url="https://sourcecraft.dev/bigbes/sr-ht-compare" +arch="x86_64" +license="MIT" +# !check — the Go tests need a live git.sr.ht API, not available in the VM +# !tracedeps — CGO_ENABLED=0, so there are no shared-object deps to trace +options="!check !tracedeps" + +# No source= : CI builds the checkout it was handed, so abuild works in place +# rather than fetching a tarball. builddir points at the repo root, which is the +# directory holding this APKBUILD. +source="" +builddir="$startdir" + +build() { + cd "$builddir" + # web/static (bundle.js + hashed CSS) is committed and go:embed-ed, so + # there is no `make css` / `make bundle` step here — see README. + CGO_ENABLED=0 make build GOFLAGS="-trimpath" +} + +package() { + cd "$builddir" + # The Makefile honours DESTDIR; ASSETS must stay the real runtime path so + # the binary's static-dir glob resolves after install. + make install DESTDIR="$pkgdir" PREFIX=/usr ASSETS=/usr/share/sourcehut +}