ci: harden production quality gates

scripts/ci-build-images.sh

@@ -9,6 +9,17 @@ registry=${AI_GATEWAY_IMAGE_REGISTRY:-registry.cn-shanghai.aliyuncs.com/easyaigc
 builder=${AI_GATEWAY_BUILDX_BUILDER:-easyai-gateway-ci}
 cache_limit=${AI_GATEWAY_BUILDX_CACHE_LIMIT:-2gb}
 platform=${AI_GATEWAY_PLATFORM:-linux/amd64}
+keep_images=0
+build_complete=0
+
+case ${1:-} in
+  '') ;;
+  --keep-images) keep_images=1 ;;
+  *)
+    echo 'usage: ci-build-images.sh [--keep-images]' >&2
+    exit 64
+    ;;
+esac
 
 if [[ ! $tag =~ ^[0-9a-f]{40}$ ]]; then
   echo 'IMAGE_TAG must be a full lowercase Git SHA' >&2
@@ -18,19 +29,45 @@ if [[ ! $registry =~ ^[A-Za-z0-9.-]+(:[0-9]+)?(/[A-Za-z0-9._/-]+)+$ ]]; then
   echo 'AI_GATEWAY_IMAGE_REGISTRY has an invalid format' >&2
   exit 1
 fi
+if [[ ! $cache_limit =~ ^[1-9][0-9]*(kb|mb|gb)$ ]]; then
+  echo 'AI_GATEWAY_BUILDX_CACHE_LIMIT has an invalid format' >&2
+  exit 1
+fi
+
+api_image="$registry/ai-gateway:$tag"
+web_image="$registry/ai-gateway-web:$tag"
+
+cleanup() {
+  original_status=$?
+  trap - EXIT HUP INT TERM
+  cleanup_status=0
+
+  docker buildx prune --builder "$builder" --force --max-used-space "$cache_limit" >/dev/null || {
+    cleanup_status=$?
+    echo 'failed to prune the CI BuildKit cache' >&2
+  }
+  if [[ $keep_images -ne 1 || $build_complete -ne 1 ]]; then
+    docker image rm "$api_image" "$web_image" >/dev/null 2>&1 || {
+      image_rm_status=$?
+      [[ $cleanup_status -ne 0 ]] || cleanup_status=$image_rm_status
+      echo 'failed to remove CI image tags' >&2
+    }
+  fi
+
+  if [[ $original_status -ne 0 ]]; then
+    exit "$original_status"
+  fi
+  exit "$cleanup_status"
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
 
 if ! docker buildx inspect "$builder" >/dev/null 2>&1; then
   docker buildx create --name "$builder" --driver docker-container --use >/dev/null
 fi
 docker buildx inspect "$builder" --bootstrap >/dev/null
-
-cleanup_cache() {
-  docker buildx prune --builder "$builder" --force --max-used-space "$cache_limit" >/dev/null || true
-}
-trap cleanup_cache EXIT HUP INT TERM
-
-api_image="$registry/ai-gateway:$tag"
-web_image="$registry/ai-gateway-web:$tag"
 common_args=(
   --builder "$builder"
   --platform "$platform"
@@ -58,4 +95,5 @@ for image in "$api_image" "$web_image"; do
     --exit-code 1 --timeout 15m "$image"
 done
 
+build_complete=1
 printf 'gateway_images=PASS git_sha=%s api=%s web=%s\n' "$tag" "$api_image" "$web_image"