ci: skip Alpine builds already published

scripts/apk/ci-package-cache.sh

@@ -29,66 +29,8 @@ registry_key_url() {
   printf '%s/api/packages/%s/alpine/key\n' "${instance_url%/}" "${owner}"
 }
 
-all_packages() {
-  while IFS= read -r package_dir; do
-    apk_package_name "${package_dir}"
-  done < <(apk_all_package_dirs "${repo_root}")
-}
-
-mark_all_packages() {
-  printf 'Rebuilding all packages: %s\n' "$1" >&2
-  all_packages
-}
-
-diff_base() {
-  local before="${GITHUB_EVENT_BEFORE:-${CI_COMMIT_BEFORE_SHA:-}}"
-  local base_ref="${GITHUB_BASE_REF:-}"
-
-  if [[ -n "${base_ref}" ]] && git rev-parse --verify "origin/${base_ref}" >/dev/null 2>&1; then
-    printf '%s...HEAD\n' "origin/${base_ref}"
-  elif [[ -n "${before}" && ! "${before}" =~ ^0+$ ]] && git rev-parse --verify "${before}^{commit}" >/dev/null 2>&1; then
-    printf '%s..HEAD\n' "${before}"
-  elif git rev-parse --verify HEAD^ >/dev/null 2>&1; then
-    printf 'HEAD^..HEAD\n'
-  else
-    return 1
-  fi
-}
-
-changed_packages() {
-  local base changed_paths changed_path package
-  declare -A selected=()
-
-  if ! base="$(diff_base)"; then
-    mark_all_packages "no usable git diff base"
-    return
-  fi
-  if ! changed_paths="$(git diff --name-only "${base}")"; then
-    mark_all_packages "git diff failed for ${base}"
-    return
-  fi
-
-  while IFS= read -r changed_path; do
-    [[ -n "${changed_path}" ]] || continue
-    case "${changed_path}" in
-      scripts/apk/*|.gitea/workflows/build.yml|mise.toml)
-        mark_all_packages "shared build logic changed"
-        return
-        ;;
-      packaging/alpine/local/*)
-        package="${changed_path#packaging/alpine/local/}"
-        selected["${package%%/*}"]=1
-        ;;
-    esac
-  done <<< "${changed_paths}"
-
-  for package in "${!selected[@]}"; do
-    printf '%s\n' "${package}"
-  done | sort
-}
-
 download_registry_metadata() {
-  local arch url
+  local arch url key_dir
 
   require_registry_config INSTANCE_URL "${instance_url}"
   require_registry_config PACKAGE_OWNER "${owner}"
@@ -99,19 +41,35 @@ download_registry_metadata() {
       --output "${registry_cache}/${arch}.APKINDEX.tar.gz" \
       "${url}/${arch}/APKINDEX.tar.gz"
   done
+  key_dir="${registry_cache}/keys"
+  mkdir -p "${key_dir}"
+  find "${key_dir}" -maxdepth 1 -type f -name '*.rsa.pub' -delete
   curl --fail --silent --show-error --location \
-    --output "${registry_cache}/registry.rsa.pub" \
+    --remote-name --remote-header-name --output-dir "${key_dir}" \
     "$(registry_key_url)"
+  registry_key_path="$(find "${key_dir}" -maxdepth 1 -type f -name '*.rsa.pub' -print -quit)"
+  if [[ -z "${registry_key_path}" ]]; then
+    printf 'registry signing key was not downloaded: %s\n' "$(registry_key_url)" >&2
+    exit 1
+  fi
 }
 
 load_registry_index() {
-  local arch package_name package_version
-  declare -gA registry_packages=()
+  local arch package_name package_version registry_key comparison
+  declare -gA registry_latest_versions=()
 
   for arch in ${arches}; do
     while IFS=$'\t' read -r package_name package_version; do
       [[ -n "${package_name}" && -n "${package_version}" ]] || continue
-      registry_packages["${arch}|${package_name}|${package_version}"]=1
+      registry_key="${arch}|${package_name}"
+      if [[ -z "${registry_latest_versions[${registry_key}]:-}" ]]; then
+        registry_latest_versions["${registry_key}"]="${package_version}"
+        continue
+      fi
+      comparison="$(apk version -t "${package_version}" "${registry_latest_versions[${registry_key}]}")"
+      if [[ "${comparison}" == ">" ]]; then
+        registry_latest_versions["${registry_key}"]="${package_version}"
+      fi
     done < <(
       tar -xOzf "${registry_cache}/${arch}.APKINDEX.tar.gz" APKINDEX | awk '
         /^P:/ { package = substr($0, 3); next }
@@ -121,25 +79,34 @@ load_registry_index() {
   done
 }
 
-registry_missing_packages() {
-  local package_dir package_name arch spec spec_name spec_version missing
+registry_upgrade_packages() {
+  local package_dir package_name arch candidate_spec candidate_version published_version comparison selected
 
   while IFS= read -r package_dir; do
     apk_validate_package_dir "${package_dir}"
     package_name="$(apk_package_name "${package_dir}")"
-    missing=0
+    selected=0
     for arch in ${arches}; do
       apk_package_supports_arch "${package_dir}" "${arch}" || continue
-      while IFS= read -r spec; do
-        spec_name="${spec%%=*}"
-        spec_version="${spec#*=}"
-        if [[ -z "${registry_packages[${arch}|${spec_name}|${spec_version}]:-}" ]]; then
-          missing=1
-          printf 'Registry miss: %s (%s, %s)\n' "${package_name}" "${arch}" "${spec}" >&2
-        fi
-      done < <(apk_package_versioned_names "${package_dir}" "${arch}")
+      IFS= read -r candidate_spec < <(apk_package_versioned_names "${package_dir}" "${arch}")
+      candidate_version="${candidate_spec#*=}"
+      published_version="${registry_latest_versions[${arch}|${package_name}]:-}"
+      if [[ -z "${published_version}" ]]; then
+        selected=1
+        printf 'Registry miss: %s (%s, %s)\n' "${package_name}" "${arch}" "${candidate_spec}" >&2
+        continue
+      fi
+      comparison="$(apk version -t "${candidate_version}" "${published_version}")"
+      if [[ "${comparison}" == ">" ]]; then
+        selected=1
+        printf 'Registry upgrade: %s (%s, %s -> %s)\n' \
+          "${package_name}" "${arch}" "${published_version}" "${candidate_version}" >&2
+      else
+        printf 'Registry current: %s (%s, source %s; published %s)\n' \
+          "${package_name}" "${arch}" "${candidate_version}" "${published_version}" >&2
+      fi
     done
-    [[ "${missing}" == 1 ]] && printf '%s\n' "${package_name}"
+    [[ "${selected}" == 1 ]] && printf '%s\n' "${package_name}"
   done < <(apk_all_package_dirs "${repo_root}")
 }
 
@@ -151,10 +118,7 @@ prepare() {
   load_registry_index
   while IFS= read -r selected; do
     [[ -n "${selected}" ]] && selected_map["${selected}"]=1
-  done < <(changed_packages)
-  while IFS= read -r selected; do
-    [[ -n "${selected}" ]] && selected_map["${selected}"]=1
-  done < <(registry_missing_packages)
+  done < <(registry_upgrade_packages)
 
   ALPINE_PACKAGES="$(for selected in "${!selected_map[@]}"; do printf '%s\n' "${selected}"; done | sort | xargs)"
   if [[ -n "${ALPINE_PACKAGES}" ]]; then
@@ -162,7 +126,7 @@ prepare() {
     printf 'Selected packages for rebuild: %s\n' "${ALPINE_PACKAGES}"
   else
     ALPINE_SKIP_BUILD=1
-    printf 'No packages selected for rebuild: registry satisfies source metadata\n'
+    printf 'No packages selected for rebuild: registry has equal or newer package versions\n'
   fi
 
   if [[ -n "${GITHUB_ENV:-}" ]]; then
@@ -170,7 +134,7 @@ prepare() {
       printf 'ALPINE_PACKAGES=%s\n' "${ALPINE_PACKAGES}"
       printf 'ALPINE_SKIP_BUILD=%s\n' "${ALPINE_SKIP_BUILD}"
       printf 'ALPINE_REGISTRY_URL=%s\n' "$(registry_url)"
-      printf 'ALPINE_REGISTRY_KEY=%s\n' "${registry_cache}/registry.rsa.pub"
+      printf 'ALPINE_REGISTRY_KEY=%s\n' "${registry_key_path}"
     } >> "${GITHUB_ENV}"
   fi
   if [[ -n "${GITHUB_OUTPUT:-}" ]]; then