alpine-packages/scripts/apk/ci-build.sh

#!/usr/bin/env bash
set -euo pipefail

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
# shellcheck source=scripts/apk/package-lib.sh
. "${repo_root}/scripts/apk/package-lib.sh"

repo_name="${ALPINE_REPO_NAME:-local}"
arches="${ALPINE_ARCHES:-x86_64 aarch64}"
packager="${PACKAGER:-local}"
selected_packages="${ALPINE_PACKAGE:-${ALPINE_PACKAGES:-}}"
skip_build="${ALPINE_SKIP_BUILD:-0}"
rust_cache_root="${ALPINE_RUST_CACHE_ROOT:-}"

if [[ "${skip_build}" == "1" ]]; then
  printf 'Skipping package build: restored package cache is complete\n'
  exit 0
fi

if [[ "${1:-}" != "--as-builder" && "$(id -u)" == "0" ]]; then
  addgroup -g 1000 builder 2>/dev/null || addgroup builder
  adduser -D -u 1000 -G builder builder 2>/dev/null || true
  addgroup builder abuild
  addgroup builder wheel
  printf 'permit nopass :wheel\n' > /etc/doas.d/wheel.conf
  printf '%%wheel ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/wheel
  chown -R builder:builder "${repo_root}"
  exec su builder -c "ALPINE_ARCHES='${arches}' ALPINE_REPO_NAME='${repo_name}' ALPINE_PACKAGES='${selected_packages}' PACKAGER='${packager}' ALPINE_RUST_CACHE_ROOT='${rust_cache_root}' '${BASH_SOURCE[0]}' --as-builder"
fi

export PACKAGER="${packager}"
export REPODEST="${repo_root}/packages"
export SRCDEST="${repo_root}/.cache/apk-distfiles"

install_repo_keys() {
  local key
  shopt -s nullglob
  for key in "${REPODEST}/${repo_name}"/*/*.rsa.pub; do
    doas cp "${key}" /etc/apk/keys/
  done
  shopt -u nullglob
}

git config --global --add safe.directory "${repo_root}"
mkdir -p "${repo_root}/.cache/abuild" "${SRCDEST}" "${REPODEST}" "${HOME}/.abuild"

if [[ ! -e "${HOME}/.abuild/abuild.conf" && -d "${repo_root}/.cache/abuild" ]]; then
  rmdir "${HOME}/.abuild" 2>/dev/null || true
  ln -s "${repo_root}/.cache/abuild" "${HOME}/.abuild"
fi

if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
  # APK signatures identify their public key by filename.  Matrix workers can
  # otherwise generate different builder-<timestamp>.rsa keys with the same
  # name when they start during the same second, making their artifacts
  # impossible to merge.  Use the selected package only while generating the
  # key so the package metadata retains the configured PACKAGER value.
  key_identity="${ALPINE_PACKAGE:-ci}"
  PACKAGER="CI key <ci-${key_identity}@local.invalid>" abuild-keygen -a -n
fi

doas cp "${HOME}"/.abuild/*.rsa.pub /etc/apk/keys/
install_repo_keys
doas apk update

while IFS= read -r package_dir; do
  apk_validate_package_dir "${package_dir}"

  for arch in ${arches}; do
    case "${arch}" in
      x86_64|aarch64) ;;
      *) printf 'unsupported Alpine architecture: %s\n' "${arch}" >&2; exit 2 ;;
    esac

    if ! apk_package_supports_arch "${package_dir}" "${arch}"; then
      printf 'Skipping %s for unsupported arch %s\n' "$(basename "${package_dir}")" "${arch}"
      continue
    fi

    printf 'Building %s for %s\n' "$(basename "${package_dir}")" "${arch}"
    (
      package_name="$(apk_package_name "${package_dir}")"
      if [[ -n "${rust_cache_root}" ]]; then
        case "${package_name}" in
          greptimedb)
            export CARGO_HOME="${rust_cache_root}/greptimedb/cargo"
            export RUSTUP_HOME="${rust_cache_root}/greptimedb/rustup"
            export CARGO_TARGET_DIR="${rust_cache_root}/greptimedb/target"
            ;;
          seaweedfs)
            export CARGO_HOME="${rust_cache_root}/seaweedfs/cargo"
            export CARGO_TARGET_DIR="${rust_cache_root}/seaweedfs/target"
            unset RUSTUP_HOME
            ;;
        esac
      fi
      cd "${package_dir}"
      ALPINE_ARCH="${arch}" CARCH="${arch}" abuild -r
    )

    mkdir -p "${REPODEST}/${repo_name}/${arch}"
    cp "${HOME}"/.abuild/*.rsa.pub "${REPODEST}/${repo_name}/${arch}/"
  done
done < <(apk_package_dirs "${repo_root}")