DSH Agent
0dcf760f13
Build and release image / build (push) Successful in 9s
Neither was visible without running the workflows for real. ## dependency-check: the report never ran `rust:1.95-bookworm` has no Node, so every run died on `exec: node: not found` before producing anything. The report needs cargo to resolve the workspace graph and Node to read four HTTP APIs and compare semantic versions — the rust image has one, the node image has the other. `.gitea/scripts/ci.Dockerfile` layers the two together, copying Node's binaries from the official image rather than adding a third-party apt repository: no extra signing key, no extra network dependency mid-build. The check now builds that image on its own pinned Rust version. Writing the parsing twice, once per language, was the alternative. It would have been two places for the pre-1.0 semver rule to drift apart. ## release: the smoke test asserted a file that shouldn't exist It required `push-state.json`, which a fresh boot does not create: `vault.json` and `push-state.json` are written when there is something to store, and a brand-new install has no accounts. The container was healthy the whole time — the assertion was simply wrong about what a first run leaves behind. It now checks the binary reports the tagged version (which is the check that actually matters, since it catches a tag pushed without a version bump) and that `vault.key` was created non-empty, which is the honest proof that the entrypoint's chown made the volume writable by the service user. Also serializes image builds across refs: a tag push and a main push can land together and both want to move the same `:latest`.
22 lines
962 B
Docker
22 lines
962 B
Docker
# CI-only image for the dependency check.
|
|
#
|
|
# The report is a Node script because it has to compare semantic versions and
|
|
# read four different HTTP APIs, and the official `rust` image ships no Node —
|
|
# while the `node` image ships no cargo, which `cargo metadata` needs to resolve
|
|
# the workspace graph. Rather than maintain the parsing twice in two languages,
|
|
# this layers the two together.
|
|
#
|
|
# Node is copied from the official image rather than installed from a
|
|
# third-party apt repository: no extra signing key, no extra network
|
|
# dependency at build time, and the same binaries everyone else runs.
|
|
ARG RUST_VERSION=1.95
|
|
ARG NODE_VERSION=22-bookworm-slim
|
|
|
|
FROM node:${NODE_VERSION} AS node
|
|
|
|
FROM rust:${RUST_VERSION}-bookworm
|
|
COPY --from=node /usr/local/bin/node /usr/local/bin/node
|
|
COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
|
|
RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
|
|
&& node --version
|