Add production Jenkins release pipelines

scripts/jenkins-checkout-source.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SOURCE_BRANCH="${SOURCE_BRANCH:-master}"
+COMMIT_HASH="${COMMIT_HASH:-}"
+GIT_REMOTE_URL="${GIT_REMOTE_URL:-}"
+SOURCE_COMMIT_FILE="${SOURCE_COMMIT_FILE:-.jenkins-source-commit}"
+
+if [[ ! "${SOURCE_BRANCH}" =~ ^[0-9A-Za-z._/-]+$ ]]; then
+  echo "[jenkins-checkout-source] SOURCE_BRANCH 只能包含数字、字母、点、下划线、短横线和斜杠: ${SOURCE_BRANCH}" >&2
+  exit 1
+fi
+
+if [[ "${SOURCE_BRANCH}" == /* || "${SOURCE_BRANCH}" == */ || "${SOURCE_BRANCH}" == *..* ]]; then
+  echo "[jenkins-checkout-source] SOURCE_BRANCH 不能以斜杠开头/结尾，也不能包含连续点号: ${SOURCE_BRANCH}" >&2
+  exit 1
+fi
+
+if [[ -n "${COMMIT_HASH}" && ! "${COMMIT_HASH}" =~ ^[0-9a-fA-F]{7,40}$ ]]; then
+  echo "[jenkins-checkout-source] COMMIT_HASH 只能填写 7 到 40 位十六进制 Git commit hash: ${COMMIT_HASH}" >&2
+  exit 1
+fi
+
+if [[ -n "${GIT_REMOTE_URL}" ]]; then
+  git remote set-url origin "${GIT_REMOTE_URL}"
+fi
+
+git reset --hard HEAD
+git fetch --tags --prune origin "+refs/heads/${SOURCE_BRANCH}:refs/remotes/origin/${SOURCE_BRANCH}"
+
+if [[ "$(git rev-parse --is-shallow-repository 2>/dev/null || echo false)" == "true" ]]; then
+  git fetch --unshallow --tags || true
+fi
+
+git cat-file -e "refs/remotes/origin/${SOURCE_BRANCH}^{commit}"
+
+if [[ -n "${COMMIT_HASH}" ]]; then
+  git cat-file -e "${COMMIT_HASH}^{commit}"
+  RESOLVED_COMMIT="$(git rev-parse "${COMMIT_HASH}^{commit}")"
+  if ! git merge-base --is-ancestor "${RESOLVED_COMMIT}" "refs/remotes/origin/${SOURCE_BRANCH}"; then
+    echo "[jenkins-checkout-source] 指定 commit 不属于 origin/${SOURCE_BRANCH}: ${RESOLVED_COMMIT}" >&2
+    exit 1
+  fi
+else
+  RESOLVED_COMMIT="$(git rev-parse "refs/remotes/origin/${SOURCE_BRANCH}^{commit}")"
+fi
+
+git checkout --detach "${RESOLVED_COMMIT}"
+git reset --hard HEAD
+git clean -fd
+
+printf "%s\n" "${RESOLVED_COMMIT}" >"${SOURCE_COMMIT_FILE}"
+echo "[jenkins-checkout-source] 使用源码: branch=${SOURCE_BRANCH} commit=${RESOLVED_COMMIT}"