conductor

CI task system
git clone git://git.finwo.net/app/conductor
Log | Files | Refs | README | LICENSE

distro.conductor.yml (1768B)

      1 # A source distribution building signed packages for two architectures.
      2 #
      3 # This is the shape the conductor was extracted from. Two details matter:
      4 #
      5 #   Each package job waits only for the build of its own architecture,
      6 #   because the dependency shares the arch dimension. The aarch64 packages
      7 #   do not sit behind the x86_64 build.
      8 #
      9 #   Signing happens on the worker. The worker holds the key and advertises
     10 #   the sign-key feature; the job asks for it by name. The conductor never
     11 #   sees the key, which is what makes it safe to accept build capacity from
     12 #   someone else's hardware.
     13 #
     14 # The package list is written out rather than discovered, since the pipeline
     15 # is data and the conductor does not run repository code to build the graph.
     16 
     17 version: 1
     18 
     19 defaults:
     20   image: debian:bookworm-slim
     21   timeout: 2h
     22 
     23 tasks:
     24   check:
     25     timeout: 10m
     26     script:
     27       - ./mk/deps.sh check
     28 
     29   toolchain:
     30     arch: [x86_64, aarch64]
     31     script:
     32       - ./mk/bootstrap-host.sh --check
     33       - ./mk/sysroot.sh --arch $ARCH
     34     artifacts:
     35       paths: ['build/sysroot-$ARCH.tar.zst']
     36       expire: 7d
     37 
     38   package:
     39     needs: [toolchain]
     40     arch: [x86_64, aarch64]
     41     matrix:
     42       pkg: [musl, busybox, glibc, grub, tinyssh, base-files]
     43     requires: [sign-key]
     44     script:
     45       - ./mk/build.sh $MATRIX_PKG $ARCH
     46     artifacts:
     47       paths: ['build/repo/$ARCH/$MATRIX_PKG-*.apk']
     48 
     49   image:
     50     needs: [package]
     51     arch: [x86_64, aarch64]
     52     script:
     53       - ./mk/rootfs.sh $ARCH
     54       - ./mk/make-img.sh $ARCH
     55     artifacts:
     56       paths: ['build/images/*-$ARCH.img']
     57 
     58   publish:
     59     # No arch of its own, so this waits for every image and every package.
     60     needs: [image, check]
     61     requires: [publish-key]
     62     script:
     63       - ./mk/repo-index.sh
     64       - ./mk/publish.sh