Genarrative/scripts/check-gitea-ci-job-image.sh

#!/usr/bin/env bash

set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
expected_toolchain="$(
  sed -n 's/^channel = "\([^"]*\)"/\1/p' "${repo_root}/rust-toolchain.toml"
)"

test -n "${expected_toolchain}"
[[ "$(node --version)" == v22.* ]]
if [[ -n "${GENARRATIVE_GITEA_CI_NPM_VERSION:-}" ]]; then
  test "$(npm --version)" = "${GENARRATIVE_GITEA_CI_NPM_VERSION}"
  printf 'npm_version=hit\n'
else
  printf 'npm_version=partial\n'
  printf '%s\n' '::warning title=CI npm version metadata is partial::The prebuilt image does not declare GENARRATIVE_GITEA_CI_NPM_VERSION; continue with the root npm ci, then refresh the trusted CI image after this migration lands.'
fi
rustup toolchain list | rg -q "^${expected_toolchain}(-[^ ]+)?( |$)"
[[ "$(rustup run "${expected_toolchain}" rustc --version)" == "rustc ${expected_toolchain} "* ]]
test "$(readlink -f "$(command -v node)")" = "/usr/local/lib/genarrative-node/bin/node"
test "$(rustup show home)" = "/usr/local/rustup"
for trusted_command in cargo rustc rustdoc rustfmt rustup; do
  test "$(command -v "${trusted_command}")" = "/usr/local/bin/${trusted_command}"
done
test "$(command -v genarrative-gitea-checkout)" = "/usr/local/bin/genarrative-gitea-checkout"
bash -n /usr/local/bin/genarrative-gitea-checkout
test -d /root/.npm/_cacache
test -d /usr/local/cargo/registry/cache

# 对象快照是可选镜像层；构建/装载前验证，运行时故障由 prepare 回退直接 rustc。
rust_cache_root=/opt/genarrative-ci/rust-cache
if [[ -d "${rust_cache_root}" && "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" != 1 ]]; then
  test "$("${rust_cache_root}/sccache" --version)" = 'sccache 0.18.0'
  rustc -vV | cmp -s - "${rust_cache_root}/rustc.txt"
  rg -q '^[a-f0-9]{40}$' "${rust_cache_root}/source-commit.txt"
  rg -q '^sha256:[a-f0-9]{64}$' "${rust_cache_root}/base-image.txt"
  test "$(cat "${rust_cache_root}/workspace.txt")" = '/workspace/GenarrativeAI/Genarrative'
  test -n "$(find "${rust_cache_root}/objects" -type f -print -quit)"
  test ! -e /workspace/GenarrativeAI/Genarrative
  printf 'rust_object_snapshot=verified\n'
fi

verify_cache_lock() {
  local cache_name="$1"
  local expected_sha256="$2"
  local lock_path="$3"
  local actual_sha256

  test -n "${expected_sha256}"
  actual_sha256="$(sha256sum "${lock_path}")"
  actual_sha256="${actual_sha256%% *}"
  if [[ "${actual_sha256}" == "${expected_sha256}" ]]; then
    printf '%s_cache_lock=hit\n' "${cache_name}"
    return
  fi
  if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
    printf '%s_cache_lock=partial\n' "${cache_name}"
    printf '::warning title=CI dependency cache is partial::%s lock differs from the prebuilt image; refresh the trusted CI image after this lock change lands.\n' "${cache_name}"
    return
  fi
  echo "${cache_name} cache lock does not match the verification checkout." >&2
  exit 1
}

npm_lock_path="${repo_root}/package-lock.json"
server_rust_lock_path="${repo_root}/server-rs/Cargo.lock"
desktop_rust_lock_path="${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock"
agc_rust_lock_path="${repo_root}/apps/ai-game-creator-shell/src-tauri/Cargo.lock"
if [[ ! -f "${npm_lock_path}" ]]; then
  npm_lock_path='/usr/local/share/genarrative-ci/npm/package-lock.json'
fi
if [[ ! -f "${server_rust_lock_path}" ]]; then
  server_rust_lock_path='/usr/local/share/genarrative-ci/locks/server-rs.Cargo.lock'
fi
if [[ ! -f "${desktop_rust_lock_path}" ]]; then
  desktop_rust_lock_path='/usr/local/share/genarrative-ci/locks/desktop-shell.Cargo.lock'
fi
if [[ ! -f "${agc_rust_lock_path}" ]]; then
  agc_rust_lock_path='/usr/local/share/genarrative-ci/locks/ai-game-creator-shell.Cargo.lock'
fi

verify_cache_lock \
  npm \
  "${GENARRATIVE_GITEA_CI_NPM_LOCK_SHA256:-}" \
  "${npm_lock_path}"
verify_cache_lock \
  server_rust \
  "${GENARRATIVE_GITEA_CI_SERVER_RUST_LOCK_SHA256:-}" \
  "${server_rust_lock_path}"
verify_cache_lock \
  desktop_rust \
  "${GENARRATIVE_GITEA_CI_DESKTOP_RUST_LOCK_SHA256:-}" \
  "${desktop_rust_lock_path}"
verify_cache_lock \
  agc_rust \
  "${GENARRATIVE_GITEA_CI_AGC_RUST_LOCK_SHA256:-}" \
  "${agc_rust_lock_path}"

for command_name in \
  bwrap \
  cargo \
  clang \
  cmake \
  curl \
  ffmpeg \
  file \
  google-chrome \
  lld \
  npm \
  patchelf \
  pkg-config \
  rg \
  rustfmt \
  rustup \
  wget; do
  command -v "${command_name}" >/dev/null
done

pkg-config --exists \
  ayatana-appindicator3-0.1 \
  libcurl \
  openssl \
  webkit2gtk-4.1

node --version
npm --version
rustup run "${expected_toolchain}" rustc --version
rustup run "${expected_toolchain}" cargo --version
rustup run "${expected_toolchain}" rustfmt --version
google-chrome --version
bwrap --version
ffmpeg -version | head -n 1

if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
  bash "${repo_root}/scripts/check-gitea-ci-job-runtime.sh"
fi