Rogeeandrogee
a5d244d293
* HH-500: add reproducible production dist bundle * HH-500: make production bundle builds reproducible * HH-500: lock complete runtime APK closure --------- Co-authored-by: Rogee <rogee@ipao.vip>
83 lines
3.2 KiB
Bash
83 lines
3.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
test_tmp=$(mktemp -d)
|
|
dirty_file=
|
|
trap 'rm -rf "$test_tmp"; [[ -z $dirty_file ]] || rm -f "$dirty_file"' EXIT HUP INT TERM
|
|
real_docker=$(command -v docker)
|
|
output="$test_tmp/dist"
|
|
|
|
mkdir -p "$test_tmp/bin"
|
|
cat > "$test_tmp/bin/docker" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
printf '%s\n' "$*" >> "$DOCKER_LOG"
|
|
[[ $1 == buildx && $2 == create ]] && exit 0
|
|
[[ $1 == buildx && $2 == rm ]] && exit 0
|
|
if [[ $1 == buildx && $2 == build ]]; then
|
|
for arg in "$@"; do
|
|
[[ $arg == type=docker,*dest=* ]] && output=${arg##*dest=}
|
|
done
|
|
fake_archive=$(mktemp -d)
|
|
printf '[]\n' > "$fake_archive/manifest.json"
|
|
tar -cf "$output" -C "$fake_archive" manifest.json
|
|
rm -rf "$fake_archive"
|
|
exit 0
|
|
fi
|
|
[[ $1 == load && $2 == --input && -s $3 ]] && exit 0
|
|
[[ $1 == image && $2 == inspect ]] && exit 0
|
|
if [[ $1 == save && $2 == --output ]]; then
|
|
fake_archive=$(mktemp -d)
|
|
printf '[]\n' > "$fake_archive/manifest.json"
|
|
tar -cf "$3" -C "$fake_archive" manifest.json
|
|
rm -rf "$fake_archive"
|
|
exit 0
|
|
fi
|
|
exit 1
|
|
EOF
|
|
chmod +x "$test_tmp/bin/docker"
|
|
|
|
cd "$root"
|
|
dirty_file=$(mktemp "$root/.build-production-dirty.XXXXXX")
|
|
if PATH="$test_tmp/bin:$PATH" DOCKER_LOG="$test_tmp/docker.log" GOCHAT_DIST_DIR="$output" \
|
|
GOCHAT_VERSION=1.2.3 bash scripts/build-production.sh >"$test_tmp/dirty.out" 2>&1; then
|
|
echo 'dirty worktree build unexpectedly succeeded' >&2
|
|
exit 1
|
|
fi
|
|
grep -q 'refusing production build from a dirty worktree' "$test_tmp/dirty.out"
|
|
rm "$dirty_file"
|
|
dirty_file=
|
|
|
|
: > "$test_tmp/docker.log"
|
|
PATH="$test_tmp/bin:$PATH" DOCKER_LOG="$test_tmp/docker.log" GOCHAT_DIST_DIR="$output" \
|
|
GOCHAT_VERSION=1.2.3 bash scripts/build-production.sh
|
|
|
|
tag=1.2.3-$(git rev-parse --short=12 HEAD)
|
|
archive="$output/images/gochat-$tag-images.tgz"
|
|
test -s "$archive"
|
|
gzip -t "$archive"
|
|
(cd "$output" && sha256sum -c SHA256SUMS)
|
|
grep -q '^GOCHAT_IMAGE_REF=gochat/gochat:1.2.3-' "$output/.env.example"
|
|
grep -q '^SHANGWUTONG_IMAGE_REF=gochat/shangwutong:1.2.3-' "$output/.env.example"
|
|
test -f "$output/deploy/fluentd/fluent.conf"
|
|
test -f "$output/deploy/prometheus/prometheus.yml"
|
|
test -f "$output/backend/configs/prometheus_alerts.yml"
|
|
test "$(grep -c '^buildx build ' "$test_tmp/docker.log")" -eq 2
|
|
test "$(grep -c '^load --input ' "$test_tmp/docker.log")" -eq 2
|
|
test "$(grep -Fc -- "--build-arg VERSION=1.2.3 --build-arg COMMIT_SHA=$(git rev-parse --short=12 HEAD) --build-arg BUILD_DATE=$(git show -s --format=%cI HEAD) --build-arg SOURCE_DATE_EPOCH=$(git show -s --format=%ct HEAD)" "$test_tmp/docker.log")" -eq 2
|
|
grep -Fq "image inspect gochat/gochat:$tag gochat/shangwutong:$tag" "$test_tmp/docker.log"
|
|
test "$(grep -c '^save --output ' "$test_tmp/docker.log")" -eq 1
|
|
grep '^save --output ' "$test_tmp/docker.log" | \
|
|
grep -Fq " gochat/gochat:$tag gochat/shangwutong:$tag"
|
|
|
|
cp "$output/.env.example" "$output/.env"
|
|
(cd "$output" && "$real_docker" compose --env-file .env -f deploy/docker/docker-compose.prod.yml config --quiet)
|
|
rm "$output/.env"
|
|
first_sum=$(sha256sum "$archive")
|
|
PATH="$test_tmp/bin:$PATH" DOCKER_LOG="$test_tmp/docker.log" GOCHAT_DIST_DIR="$output" \
|
|
GOCHAT_VERSION=1.2.3 bash scripts/build-production.sh
|
|
test "$first_sum" = "$(sha256sum "$archive")"
|
|
|
|
echo 'production build script test passed'
|