From 5836cb69cc980623937659a12d589a7333723586 Mon Sep 17 00:00:00 2001 From: Eugene Blikh Date: Wed, 5 Aug 2026 06:39:37 +0300 Subject: [PATCH] ci(apk): commit the build, packaging and mirror-trigger files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These three were written but never committed, so the whole publishing chain was dead from its first link: with no .build.yml on sourcecraft there is none on the git.srht.bigb.es mirror either, so the push hook has no manifest to submit, no build ever ran, and dolt.sr.ht has never appeared in the apk index at repo.bigb.es — which today holds spec.sr.ht alone. The code itself was mirroring fine, which is what made this hard to see: the sourcehut side sits on the current commit, so everything looks configured until you ask git which of these files it actually knows about. .sourcecraft/webhooks.yaml is in the same state and has the same consequence one level up: the gitsync webhook was never registered, so the mirror has been riding its hourly safety-net poll rather than updating on push. The build secret apk-ci-s3 the publish task needs now exists on the account, so nothing else blocks the first build. --- .build.yml | 82 ++++++++++++++++++++++++++++++++++++++ .sourcecraft/webhooks.yaml | 24 +++++++++++ APKBUILD | 54 +++++++++++++++++++++++++ 3 files changed, 160 insertions(+) create mode 100644 .build.yml create mode 100644 .sourcecraft/webhooks.yaml create mode 100644 APKBUILD diff --git a/.build.yml b/.build.yml new file mode 100644 index 0000000000000000000000000000000000000000..4f3af820fd7e8856da75ad5143be50260145e5d9 --- /dev/null +++ b/.build.yml @@ -0,0 +1,82 @@ +image: alpine/edge +packages: + - abuild + - go + - git + - rclone + - sassc + - minify +secrets: + # File secret `apk-ci-s3`, installed at ~/.apk-ci.env, containing + # APK_CI_S3_ACCESS_KEY / APK_CI_S3_SECRET_KEY for the Garage `repo` bucket. + - apk-ci-s3 +sources: + - https://git.srht.bigb.es/~bigbes/sr-ht-dolt +environment: + REPO: sr-ht-dolt + APK_REPO: alpine/v3.22/bigbes/x86_64 + S3_BUCKET: repo + S3_ENDPOINT: https://s3.bigb.es + # Must track the srht deployment's SRHT_CORE_VER, or this service's theme + # drifts from the rest of the instance. BOOTSTRAP_REV is the submodule commit + # core.sr.ht pins at that tag; bump the two together. + CORE_VER: "0.83.8" + BOOTSTRAP_REV: 779ad9f174ea5ab7e755f6df0ec9e5912d67dd16 +submitter: + git.sr.ht: + allow-refs: + - refs/heads/master +tasks: + - scss: | + # No apk ships the shared sourcehut SCSS partials, so assemble them the + # way core.sr.ht's `make install-scss` would: its own scss/ plus the + # Bootstrap 4 submodule. `make css` runs sassc -I against this tree. + git clone --depth 1 --branch "$CORE_VER" \ + https://git.sr.ht/~sircmpwn/core.sr.ht /tmp/core + sudo mkdir -p /usr/share/sourcehut/scss/bootstrap + sudo cp /tmp/core/scss/*.scss /tmp/core/scss/*.css /usr/share/sourcehut/scss/ + git init -q /tmp/bootstrap + git -C /tmp/bootstrap remote add origin https://github.com/twbs/bootstrap + git -C /tmp/bootstrap fetch -q --depth 1 origin "$BOOTSTRAP_REV" + git -C /tmp/bootstrap checkout -q FETCH_HEAD + sudo cp -r /tmp/bootstrap/scss /usr/share/sourcehut/scss/bootstrap/scss + - keygen: | + # abuild insists on signing what it builds, but this key is deliberately + # throwaway: generated per build, dies with the VM, trusted by nothing. + # Clients verify against the index instead, which is rebuilt and signed on + # phoebe by the garage stack's apk-mirror service — it indexes this repo + # with --allow-untrusted precisely because of this. + # + # -i installs the public half into /etc/apk/keys. Without it abuild's own + # final "update the local repository index" step dies with UNTRUSTED + # signature, after having built the package perfectly well. + SUDO=sudo abuild-keygen -a -n -i -q + - version: | + cd "$REPO" + ver="0.0.$(git rev-list --count HEAD)" + sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD + echo "export PKGVER=$ver" >> ~/.buildenv + echo "building $ver" + - build: | + cd "$REPO" + # -d: makedepends are already installed via `packages:` above. + REPODEST=$HOME/packages abuild -d + find "$HOME/packages" -name '*.apk' + - publish: | + set +x # never echo the S3 credentials into the build log + . ~/.apk-ci.env + export RCLONE_CONFIG_GARAGE_TYPE=s3 + export RCLONE_CONFIG_GARAGE_PROVIDER=Other + export RCLONE_CONFIG_GARAGE_ENDPOINT="$S3_ENDPOINT" + export RCLONE_CONFIG_GARAGE_REGION=garage + export RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE=true + export RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID="$APK_CI_S3_ACCESS_KEY" + export RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY="$APK_CI_S3_SECRET_KEY" + set -x + # Upload only; never delete. Old versions stay so a pinned deployment can + # always be rebuilt — the same reason the upstream mirror is append-only. + find "$HOME/packages" -name '*.apk' -print | while read -r f; do + rclone copyto "$f" "garage:$S3_BUCKET/$APK_REPO/$(basename "$f")" + echo "uploaded $(basename "$f")" + done + echo "published; apk-mirror on phoebe re-indexes within 15 minutes" diff --git a/.sourcecraft/webhooks.yaml b/.sourcecraft/webhooks.yaml new file mode 100644 index 0000000000000000000000000000000000000000..56f207f6ddcdf2aa82d3d79b7353cd6fd6eecaca --- /dev/null +++ b/.sourcecraft/webhooks.yaml @@ -0,0 +1,24 @@ +# Notifies the lab's gitsync service that this repo has moved, so the mirror on +# our self-hosted sourcehut updates within seconds instead of waiting for its +# hourly safety-net poll. That matters beyond the mirror itself: builds.sr.ht CI +# (see .build.yml) only fires once the commit lands on the sourcehut side, so +# this webhook is what makes push -> apk build feel immediate. +# +# The receiver verifies the HMAC-SHA256 in X-Src-Signature over the request +# body. The signing key is generated by SourceCraft, is not part of this file, +# and is read once from Автоматизации -> Вебхуки into the gitsync stack's .env. +# +# The slug is unique per repository, but the receiver serves all three repos and +# maps slug -> signing key, so it must be unique ACROSS them too — hence the +# suffix rather than a plain "gitsync". +webhooks: + hooks: + - slug: gitsync-dolt + name: "gitsync mirror trigger" + description: "Triggers the phoebe gitsync service to mirror sr-ht-dolt to git.srht.bigb.es" + url: "https://gitsync.bigb.es/hook" + ssl_verification: true + active: true + on: + push: + - hooks: ["gitsync-dolt"] diff --git a/APKBUILD b/APKBUILD new file mode 100644 index 0000000000000000000000000000000000000000..8e3d04f3447b00df60c5e6d432c9d363a2b68740 --- /dev/null +++ b/APKBUILD @@ -0,0 +1,54 @@ +# Maintainer: bigbes +# +# Built by builds.sr.ht (.build.yml) and published to our own apk repo at +# repo.bigb.es/alpine/v3.22/bigbes. The srht deployment installs it from there +# instead of cloning and compiling this repo inside its Dockerfile. +# +# pkgver is rewritten by CI to 0.0. before abuild runs — a +# monotonic, unique-per-commit version that the deployment can pin. +pkgname=dolt.sr.ht +pkgver=0.0.0 +pkgrel=0 +pkgdesc="Dolt database hosting for a sourcehut instance" +url="https://sourcecraft.dev/bigbes/sr-ht-dolt" +arch="x86_64" +license="MIT" +# !check — tests want a live Postgres and a chunk store +# !tracedeps — CGO_ENABLED=0 with -tags gms_pure_go, so the binaries are +# static: no ICU, no gozstd, nothing to trace +options="!check !tracedeps" + +source="" +builddir="$startdir" + +# The pure-Go build tag is what keeps this package free of cgo: it selects +# go-mysql-server's stdlib regexp instead of go-icu-regex (the SQL engine is +# never run here), and a replace directive backs gozstd with a klauspost shim. +# Dropping it would pull in libicu and make the package arch/libc-specific. +export GO_TAGS="gms_pure_go" + +build() { + cd "$builddir" + # `make all` is all-bin ONLY — this Makefile deliberately keeps the CSS off + # the default path because sassc/minify aren't always on a dev machine. So + # `css` has to be asked for by name; building `all` alone silently produces + # a package with no stylesheet. + CGO_ENABLED=0 make all-bin GO_TAGS="$GO_TAGS" + # Needs the shared sourcehut scss partials pre-assembled at ASSETS/scss (no + # apk ships them); CI does that before calling abuild. + make css ASSETS=/usr/share/sourcehut + + # install-share copies static/*.css under `2>/dev/null || true`, so a + # stylesheet that never got built would ship as an unstyled service without + # failing anything. Assert it exists instead. The hashed copy is the one the + # service finds by globbing its static dir at startup. + ls static/main.min.*.css >/dev/null +} + +package() { + cd "$builddir" + # This Makefile's install rules do not honour DESTDIR (they write to + # $(BINDIR)/$(SHAREDIR) directly), so the staging dir is passed as PREFIX. + # MIGRATIONDIR and STATICDIR are both derived from SHAREDIR, so they follow. + make install PREFIX="$pkgdir/usr" +}