~bigbes/sr-ht-spec

ref: 61515a575dc7e931829c05eed0cd3c3a441df753 sr-ht-spec/.build.yml -rw-r--r-- 3.5 KiB
61515a57 — Eugene Blikh chore(beads): file spec-ejq.2, CI publish blocked on missing apk-ci-s3 secret 25 days ago 
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

image: alpine/edge
packages:
  - abuild
  - go
  - git
  - rclone
  - sassc
  - minify
secrets:
  # File secret `apk-ci-s3`, installed at ~/.apk-ci.env, containing
  # APK_CI_S3_ACCESS_KEY / APK_CI_S3_SECRET_KEY for the Garage `repo` bucket.
  - apk-ci-s3
sources:
  - https://git.srht.bigb.es/~bigbes/sr-ht-spec
environment:
  REPO: sr-ht-spec
  APK_REPO: alpine/v3.22/bigbes/x86_64
  S3_BUCKET: repo
  S3_ENDPOINT: https://s3.bigb.es
  # Must track the srht deployment's SRHT_CORE_VER, or this service's theme
  # drifts from the rest of the instance. BOOTSTRAP_REV is the submodule commit
  # core.sr.ht pins at that tag; bump the two together.
  CORE_VER: "0.83.8"
  BOOTSTRAP_REV: 779ad9f174ea5ab7e755f6df0ec9e5912d67dd16
submitter:
  git.sr.ht:
    allow-refs:
      - refs/heads/master
tasks:
  - scss: |
      # No apk ships the shared sourcehut SCSS partials, so assemble them the
      # way core.sr.ht's `make install-scss` would: its own scss/ plus the
      # Bootstrap 4 submodule. `make css` runs sassc -I against this tree.
      git clone --depth 1 --branch "$CORE_VER" \
        https://git.sr.ht/~sircmpwn/core.sr.ht /tmp/core
      sudo mkdir -p /usr/share/sourcehut/scss/bootstrap
      sudo cp /tmp/core/scss/*.scss /tmp/core/scss/*.css /usr/share/sourcehut/scss/
      git init -q /tmp/bootstrap
      git -C /tmp/bootstrap remote add origin https://github.com/twbs/bootstrap
      git -C /tmp/bootstrap fetch -q --depth 1 origin "$BOOTSTRAP_REV"
      git -C /tmp/bootstrap checkout -q FETCH_HEAD
      sudo cp -r /tmp/bootstrap/scss /usr/share/sourcehut/scss/bootstrap/scss
  - keygen: |
      # abuild insists on signing what it builds, but this key is deliberately
      # throwaway: generated per build, dies with the VM, trusted by nothing.
      # Clients verify against the index instead, which is rebuilt and signed on
      # phoebe by the garage stack's apk-mirror service — it indexes this repo
      # with --allow-untrusted precisely because of this.
      #
      # -i installs the public half into /etc/apk/keys. Without it abuild's own
      # final "update the local repository index" step dies with UNTRUSTED
      # signature, after having built the package perfectly well.
      SUDO=sudo abuild-keygen -a -n -i -q
  - version: |
      cd "$REPO"
      ver="0.0.$(git rev-list --count HEAD)"
      sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD
      echo "export PKGVER=$ver" >> ~/.buildenv
      echo "building $ver"
  - build: |
      cd "$REPO"
      # -d: makedepends are already installed via `packages:` above.
      REPODEST=$HOME/packages abuild -d
      find "$HOME/packages" -name '*.apk'
  - publish: |
      set +x   # never echo the S3 credentials into the build log
      . ~/.apk-ci.env
      export RCLONE_CONFIG_GARAGE_TYPE=s3
      export RCLONE_CONFIG_GARAGE_PROVIDER=Other
      export RCLONE_CONFIG_GARAGE_ENDPOINT="$S3_ENDPOINT"
      export RCLONE_CONFIG_GARAGE_REGION=garage
      export RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE=true
      export RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID="$APK_CI_S3_ACCESS_KEY"
      export RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY="$APK_CI_S3_SECRET_KEY"
      set -x
      # Upload only; never delete. Old versions stay so a pinned deployment can
      # always be rebuilt — the same reason the upstream mirror is append-only.
      find "$HOME/packages" -name '*.apk' -print | while read -r f; do
        rclone copyto "$f" "garage:$S3_BUCKET/$APK_REPO/$(basename "$f")"
        echo "uploaded $(basename "$f")"
      done
      echo "published; apk-mirror on phoebe re-indexes within 15 minutes"