102 lines
3.0 KiB
Bash
Executable File
102 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
cd "$root"
|
|
|
|
tag=${IMAGE_TAG:-}
|
|
registry=${AI_GATEWAY_IMAGE_REGISTRY:-registry.cn-shanghai.aliyuncs.com/easyaigc}
|
|
builder=${AI_GATEWAY_BUILDX_BUILDER:-easyai-gateway-ci}
|
|
cache_limit=${AI_GATEWAY_BUILDX_CACHE_LIMIT:-2gb}
|
|
platform=${AI_GATEWAY_PLATFORM:-linux/amd64}
|
|
keep_images=0
|
|
build_complete=0
|
|
readonly trivy_db_repository=ghcr.m.daocloud.io/aquasecurity/trivy-db:2
|
|
|
|
case ${1:-} in
|
|
'') ;;
|
|
--keep-images) keep_images=1 ;;
|
|
*)
|
|
echo 'usage: ci-build-images.sh [--keep-images]' >&2
|
|
exit 64
|
|
;;
|
|
esac
|
|
|
|
if [[ ! $tag =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo 'IMAGE_TAG must be a full lowercase Git SHA' >&2
|
|
exit 1
|
|
fi
|
|
if [[ ! $registry =~ ^[A-Za-z0-9.-]+(:[0-9]+)?(/[A-Za-z0-9._/-]+)+$ ]]; then
|
|
echo 'AI_GATEWAY_IMAGE_REGISTRY has an invalid format' >&2
|
|
exit 1
|
|
fi
|
|
if [[ ! $cache_limit =~ ^[1-9][0-9]*(kb|mb|gb)$ ]]; then
|
|
echo 'AI_GATEWAY_BUILDX_CACHE_LIMIT has an invalid format' >&2
|
|
exit 1
|
|
fi
|
|
|
|
api_image="$registry/ai-gateway:$tag"
|
|
web_image="$registry/ai-gateway-web:$tag"
|
|
|
|
cleanup() {
|
|
original_status=$?
|
|
trap - EXIT HUP INT TERM
|
|
cleanup_status=0
|
|
|
|
docker buildx prune --builder "$builder" --force --max-used-space "$cache_limit" >/dev/null || {
|
|
cleanup_status=$?
|
|
echo 'failed to prune the CI BuildKit cache' >&2
|
|
}
|
|
if [[ $keep_images -ne 1 || $build_complete -ne 1 ]]; then
|
|
docker image rm "$api_image" "$web_image" >/dev/null 2>&1 || {
|
|
image_rm_status=$?
|
|
[[ $cleanup_status -ne 0 ]] || cleanup_status=$image_rm_status
|
|
echo 'failed to remove CI image tags' >&2
|
|
}
|
|
fi
|
|
|
|
if [[ $original_status -ne 0 ]]; then
|
|
exit "$original_status"
|
|
fi
|
|
exit "$cleanup_status"
|
|
}
|
|
trap cleanup EXIT
|
|
trap 'exit 129' HUP
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
|
|
if ! docker buildx inspect "$builder" >/dev/null 2>&1; then
|
|
docker buildx create --name "$builder" --driver docker-container --use >/dev/null
|
|
fi
|
|
docker buildx inspect "$builder" --bootstrap >/dev/null
|
|
common_args=(
|
|
--builder "$builder"
|
|
--platform "$platform"
|
|
--file Dockerfile
|
|
--pull
|
|
--load
|
|
)
|
|
|
|
docker buildx build --builder "$builder" \
|
|
"${common_args[@]:2}" \
|
|
--target api \
|
|
--build-arg "GO_BUILD_IMAGE=${AI_GATEWAY_GO_BUILD_IMAGE:-docker.m.daocloud.io/library/golang:1.26.5-alpine}" \
|
|
--build-arg "API_RUNTIME_IMAGE=${AI_GATEWAY_API_RUNTIME_IMAGE:-docker.m.daocloud.io/library/alpine:3.22}" \
|
|
--tag "$api_image" .
|
|
|
|
docker buildx build --builder "$builder" \
|
|
"${common_args[@]:2}" \
|
|
--target web \
|
|
--build-arg "NODE_BUILD_IMAGE=${AI_GATEWAY_NODE_BUILD_IMAGE:-docker.m.daocloud.io/library/node:24-alpine}" \
|
|
--build-arg "WEB_RUNTIME_IMAGE=${AI_GATEWAY_WEB_RUNTIME_IMAGE:-docker.m.daocloud.io/library/nginx:1.27-alpine}" \
|
|
--tag "$web_image" .
|
|
|
|
for image in "$api_image" "$web_image"; do
|
|
trivy image --db-repository "$trivy_db_repository" \
|
|
--scanners vuln,secret --severity HIGH,CRITICAL --ignore-unfixed \
|
|
--exit-code 1 --timeout 15m "$image"
|
|
done
|
|
|
|
build_complete=1
|
|
printf 'gateway_images=PASS git_sha=%s api=%s web=%s\n' "$tag" "$api_image" "$web_image"
|