chengcheng
745811cc6d
新增独立仓库级 Gitea Runner，main 和 PR 执行完整质量门禁与不可变 SHA 镜像构建；只有来自 main 历史的语义版本 Tag 才调用受限生产发布助手。专属 Buildx builder 将缓存限制为 2 GB。\n\n验证：流水线结构测试、ShellCheck、Go vet/test、govulncheck、前端 lint/test/build、Compose 渲染及高危依赖审计通过。
62 lines
2.0 KiB
Bash
Executable File
62 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
cd "$root"
|
|
|
|
tag=${IMAGE_TAG:-}
|
|
registry=${AI_GATEWAY_IMAGE_REGISTRY:-registry.cn-shanghai.aliyuncs.com/easyaigc}
|
|
builder=${AI_GATEWAY_BUILDX_BUILDER:-easyai-gateway-ci}
|
|
cache_limit=${AI_GATEWAY_BUILDX_CACHE_LIMIT:-2gb}
|
|
platform=${AI_GATEWAY_PLATFORM:-linux/amd64}
|
|
|
|
if [[ ! $tag =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo 'IMAGE_TAG must be a full lowercase Git SHA' >&2
|
|
exit 1
|
|
fi
|
|
if [[ ! $registry =~ ^[A-Za-z0-9.-]+(:[0-9]+)?(/[A-Za-z0-9._/-]+)+$ ]]; then
|
|
echo 'AI_GATEWAY_IMAGE_REGISTRY has an invalid format' >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! docker buildx inspect "$builder" >/dev/null 2>&1; then
|
|
docker buildx create --name "$builder" --driver docker-container --use >/dev/null
|
|
fi
|
|
docker buildx inspect "$builder" --bootstrap >/dev/null
|
|
|
|
cleanup_cache() {
|
|
docker buildx prune --builder "$builder" --force --max-used-space "$cache_limit" >/dev/null || true
|
|
}
|
|
trap cleanup_cache EXIT HUP INT TERM
|
|
|
|
api_image="$registry/ai-gateway:$tag"
|
|
web_image="$registry/ai-gateway-web:$tag"
|
|
common_args=(
|
|
--builder "$builder"
|
|
--platform "$platform"
|
|
--file Dockerfile
|
|
--pull
|
|
--load
|
|
)
|
|
|
|
docker buildx build --builder "$builder" \
|
|
"${common_args[@]:2}" \
|
|
--target api \
|
|
--build-arg "GO_BUILD_IMAGE=${AI_GATEWAY_GO_BUILD_IMAGE:-docker.m.daocloud.io/library/golang:1.26.5-alpine}" \
|
|
--build-arg "API_RUNTIME_IMAGE=${AI_GATEWAY_API_RUNTIME_IMAGE:-docker.m.daocloud.io/library/alpine:3.22}" \
|
|
--tag "$api_image" .
|
|
|
|
docker buildx build --builder "$builder" \
|
|
"${common_args[@]:2}" \
|
|
--target web \
|
|
--build-arg "NODE_BUILD_IMAGE=${AI_GATEWAY_NODE_BUILD_IMAGE:-docker.m.daocloud.io/library/node:24-alpine}" \
|
|
--build-arg "WEB_RUNTIME_IMAGE=${AI_GATEWAY_WEB_RUNTIME_IMAGE:-docker.m.daocloud.io/library/nginx:1.27-alpine}" \
|
|
--tag "$web_image" .
|
|
|
|
for image in "$api_image" "$web_image"; do
|
|
trivy image --scanners vuln,secret --severity HIGH,CRITICAL --ignore-unfixed \
|
|
--exit-code 1 --timeout 15m "$image"
|
|
done
|
|
|
|
printf 'gateway_images=PASS git_sha=%s api=%s web=%s\n' "$tag" "$api_image" "$web_image"
|