合并最新 master 分支

2026-07-22 10:06:45 +00:00
parent 7b9025b201 9bb4942ae7
commit 733fbb55d9
24 changed files with 3418 additions and 672 deletions
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+expected_toolchain="$(
+  sed -n 's/^channel = "\([^"]*\)"/\1/p' "${repo_root}/rust-toolchain.toml"
+)"
+
+test -n "${expected_toolchain}"
+[[ "$(node --version)" == v22.* ]]
+rustup toolchain list | rg -q "^${expected_toolchain}(-[^ ]+)?( |$)"
+[[ "$(rustup run "${expected_toolchain}" rustc --version)" == "rustc ${expected_toolchain} "* ]]
+test "$(readlink -f "$(command -v node)")" = "/usr/local/lib/genarrative-node/bin/node"
+test "$(rustup show home)" = "/usr/local/rustup"
+for trusted_command in cargo rustc rustdoc rustfmt rustup; do
+  test "$(command -v "${trusted_command}")" = "/usr/local/bin/${trusted_command}"
+done
+test "$(command -v genarrative-gitea-checkout)" = "/usr/local/bin/genarrative-gitea-checkout"
+bash -n /usr/local/bin/genarrative-gitea-checkout
+test -d /root/.npm/_cacache
+test -d /usr/local/cargo/registry/cache
+
+verify_cache_lock() {
+  local cache_name="$1"
+  local expected_sha256="$2"
+  local lock_path="$3"
+  local actual_sha256
+
+  test -n "${expected_sha256}"
+  actual_sha256="$(sha256sum "${lock_path}")"
+  actual_sha256="${actual_sha256%% *}"
+  if [[ "${actual_sha256}" == "${expected_sha256}" ]]; then
+    printf '%s_cache_lock=hit\n' "${cache_name}"
+    return
+  fi
+  if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
+    printf '%s_cache_lock=partial\n' "${cache_name}"
+    return
+  fi
+  echo "${cache_name} cache lock does not match the verification checkout." >&2
+  exit 1
+}
+
+npm_lock_path="${repo_root}/package-lock.json"
+server_rust_lock_path="${repo_root}/server-rs/Cargo.lock"
+desktop_rust_lock_path="${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock"
+if [[ ! -f "${npm_lock_path}" ]]; then
+  npm_lock_path='/usr/local/share/genarrative-ci/npm/package-lock.json'
+fi
+if [[ ! -f "${server_rust_lock_path}" ]]; then
+  server_rust_lock_path='/usr/local/share/genarrative-ci/locks/server-rs.Cargo.lock'
+fi
+if [[ ! -f "${desktop_rust_lock_path}" ]]; then
+  desktop_rust_lock_path='/usr/local/share/genarrative-ci/locks/desktop-shell.Cargo.lock'
+fi
+
+verify_cache_lock \
+  npm \
+  "${GENARRATIVE_GITEA_CI_NPM_LOCK_SHA256:-}" \
+  "${npm_lock_path}"
+verify_cache_lock \
+  server_rust \
+  "${GENARRATIVE_GITEA_CI_SERVER_RUST_LOCK_SHA256:-}" \
+  "${server_rust_lock_path}"
+verify_cache_lock \
+  desktop_rust \
+  "${GENARRATIVE_GITEA_CI_DESKTOP_RUST_LOCK_SHA256:-}" \
+  "${desktop_rust_lock_path}"
+
+for command_name in \
+  bwrap \
+  cargo \
+  clang \
+  cmake \
+  curl \
+  ffmpeg \
+  file \
+  google-chrome \
+  lld \
+  npm \
+  patchelf \
+  pkg-config \
+  rg \
+  rustfmt \
+  rustup \
+  wget; do
+  command -v "${command_name}" >/dev/null
+done
+
+pkg-config --exists \
+  ayatana-appindicator3-0.1 \
+  libcurl \
+  openssl \
+  webkit2gtk-4.1
+
+node --version
+npm --version
+rustup run "${expected_toolchain}" rustc --version
+rustup run "${expected_toolchain}" cargo --version
+rustup run "${expected_toolchain}" rustfmt --version
+google-chrome --version
+bwrap --version
+ffmpeg -version | head -n 1
+
+if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
+  bash "${repo_root}/scripts/check-gitea-ci-job-runtime.sh"
+fi
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+bwrap_args=(
+  --die-with-parent
+  --unshare-all
+  --unshare-user
+  --disable-userns
+  --assert-userns-disabled
+  --cap-drop ALL
+  --clearenv
+  --ro-bind /usr /usr
+)
+for merged_path in /bin /sbin /lib /lib64; do
+  if [[ -L "${merged_path}" ]]; then
+    bwrap_args+=(--symlink "$(readlink "${merged_path}")" "${merged_path}")
+  fi
+done
+bwrap_args+=(
+  --proc /proc
+  --dev /dev
+  --tmpfs /tmp
+  --
+  /usr/bin/true
+)
+bwrap "${bwrap_args[@]}"
+
+chrome_output="$(
+  timeout 30 google-chrome \
+    --headless=new \
+    --no-sandbox \
+    --disable-dev-shm-usage \
+    --disable-gpu \
+    --dump-dom \
+    'data:text/html,<title>genarrative-ci</title>' \
+    2>/dev/null
+)"
+rg -q '<title>genarrative-ci</title>' <<< "${chrome_output}"
@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+dockerfile_context_path="deploy/container/gitea-ci-job.Dockerfile"
+image_tag="${GENARRATIVE_GITEA_CI_IMAGE_TAG:-genarrative/gitea-project-ci:20260722.2}"
+runner_container="${GENARRATIVE_GITEA_RUNNER_CONTAINER:-gitea-runner}"
+
+write_build_context_file_list() {
+  printf '%s\0' \
+    deploy/container/gitea-ci-job.Dockerfile \
+    deploy/container/gitea-ci-job.Dockerfile.dockerignore \
+    deploy/container/gitea-ci-checkout.sh \
+    package.json \
+    package-lock.json \
+    server-rs/Cargo.toml \
+    server-rs/Cargo.lock \
+    apps/desktop-shell/src-tauri/Cargo.toml \
+    apps/desktop-shell/src-tauri/Cargo.lock
+  find server-rs/crates -name Cargo.toml -print0 | sort -z
+}
+
+usage() {
+  cat <<'EOF'
+用法：
+  bash scripts/gitea-ci-job-image.sh build
+  bash scripts/gitea-ci-job-image.sh verify [镜像引用]
+  bash scripts/gitea-ci-job-image.sh load-runner [镜像引用]
+  bash scripts/gitea-ci-job-image.sh export <归档路径> [镜像引用]
+
+环境变量：
+  GENARRATIVE_GITEA_CI_IMAGE_TAG       覆盖本地构建 tag
+  GENARRATIVE_GITEA_RUNNER_CONTAINER   覆盖 Runner 容器名
+EOF
+}
+
+image_id() {
+  docker image inspect --format '{{.Id}}' "$1"
+}
+
+verify_image() {
+  local image_ref="$1"
+  docker run --rm \
+    --mount "type=bind,src=${repo_root}/scripts,dst=/usr/local/scripts,readonly" \
+    --mount "type=bind,src=${repo_root}/scripts/check-gitea-ci-job-image.sh,dst=/usr/local/bin/check-gitea-ci-job-image.sh,readonly" \
+    --mount "type=bind,src=${repo_root}/rust-toolchain.toml,dst=/usr/local/rust-toolchain.toml,readonly" \
+    "${image_ref}" \
+    bash /usr/local/bin/check-gitea-ci-job-image.sh
+}
+
+command_name="${1:-}"
+case "${command_name}" in
+  build)
+    image_revision="$(
+      cd "${repo_root}"
+      {
+        sha256sum \
+          deploy/container/gitea-ci-job.Dockerfile \
+          deploy/container/gitea-ci-job.Dockerfile.dockerignore \
+          deploy/container/gitea-ci-checkout.sh \
+          package.json \
+          package-lock.json \
+          server-rs/Cargo.toml \
+          server-rs/Cargo.lock \
+          apps/desktop-shell/src-tauri/Cargo.toml \
+          apps/desktop-shell/src-tauri/Cargo.lock
+        find server-rs/crates -name Cargo.toml -print0 \
+          | sort -z \
+          | xargs -0 -r sha256sum
+      } \
+        | sha256sum \
+        | awk '{ print $1 }'
+    )"
+    npm_lock_sha256="$(sha256sum "${repo_root}/package-lock.json")"
+    npm_lock_sha256="${npm_lock_sha256%% *}"
+    server_rust_lock_sha256="$(sha256sum "${repo_root}/server-rs/Cargo.lock")"
+    server_rust_lock_sha256="${server_rust_lock_sha256%% *}"
+    desktop_rust_lock_sha256="$(sha256sum "${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock")"
+    desktop_rust_lock_sha256="${desktop_rust_lock_sha256%% *}"
+    (
+      cd "${repo_root}"
+      write_build_context_file_list \
+        | tar --null --create --file - --files-from=- \
+        | docker build \
+          --pull=false \
+          --build-arg "IMAGE_REVISION=${image_revision}" \
+          --build-arg "NPM_LOCK_SHA256=${npm_lock_sha256}" \
+          --build-arg "SERVER_RUST_LOCK_SHA256=${server_rust_lock_sha256}" \
+          --build-arg "DESKTOP_RUST_LOCK_SHA256=${desktop_rust_lock_sha256}" \
+          --file "${dockerfile_context_path}" \
+          --tag "${image_tag}" \
+          -
+    )
+    verify_image "${image_tag}"
+    printf 'image_tag=%s\n' "${image_tag}"
+    printf 'image_id=%s\n' "$(image_id "${image_tag}")"
+    ;;
+  verify)
+    image_ref="${2:-${image_tag}}"
+    verify_image "${image_ref}"
+    printf 'image_ref=%s\n' "${image_ref}"
+    printf 'image_id=%s\n' "$(image_id "${image_ref}")"
+    ;;
+  load-runner)
+    image_ref="${2:-${image_tag}}"
+    verify_image "${image_ref}"
+    expected_image_id="$(image_id "${image_ref}")"
+    docker save "${image_ref}" | docker exec -i "${runner_container}" docker load
+    loaded_image_id="$(
+      docker exec "${runner_container}" \
+        docker image inspect --format '{{.Id}}' "${image_ref}"
+    )"
+    test "${loaded_image_id}" = "${expected_image_id}"
+    docker exec -i "${runner_container}" \
+      docker run --rm --interactive \
+      --security-opt seccomp=unconfined \
+      --security-opt systempaths=unconfined \
+      "${loaded_image_id}" bash -s \
+      < "${repo_root}/scripts/check-gitea-ci-job-runtime.sh"
+    printf 'runner_image_tag=%s\n' "${image_ref}"
+    printf 'runner_image_id=%s\n' "${loaded_image_id}"
+    printf 'runner_label_image=docker://%s\n' "${loaded_image_id}"
+    ;;
+  export)
+    archive_path="${2:-}"
+    image_ref="${3:-${image_tag}}"
+    test -n "${archive_path}"
+    verify_image "${image_ref}"
+    docker save "${image_ref}" | zstd --threads=0 --ultra -10 -o "${archive_path}"
+    archive_dir="$(cd "$(dirname "${archive_path}")" && pwd -P)"
+    archive_name="$(basename "${archive_path}")"
+    (
+      cd "${archive_dir}"
+      sha256sum "${archive_name}" > "${archive_name}.sha256"
+    )
+    printf 'archive=%s\n' "${archive_path}"
+    printf 'image_id=%s\n' "$(image_id "${image_ref}")"
+    ;;
+  *)
+    usage >&2
+    exit 2
+    ;;
+esac