commit 49e247d6cf79eba2145da12978a2a7c28ebc0da5
parent eb22cdd61150eeba3a0e2862b86a6666dff45100
Author: Robin Bron <robin.bron@yourhosting.nl>
Date: Mon, 28 Sep 2026 23:21:46 +0200
Setup toolchain once instead of for each package
Diffstat:
8 files changed, 173 insertions(+), 93 deletions(-)
diff --git a/.conductor.yml b/.conductor.yml
@@ -6,18 +6,30 @@
version: 1
defaults:
- image: debian:bookworm-slim
+ image: finwo/unos-builder:0.1.0
timeout: 2h
env:
DEBIAN_FRONTEND: noninteractive
tasks:
+ builder:
+ timeout: 30m
+ arch: [x86_64]
+ image: docker:28-cli
+ requires: [docker]
+ script:
+ - ./mk/publish-builder.sh
+
check:
+ needs:
+ - builder
timeout: 30m
arch: [x86_64]
requires: [unos-sign-key]
script:
- - ./mk/ci-setup.sh
+ # --check, not an install: the toolchain is baked into the builder image,
+ # and this is what fails when a template outgrows it without a bump.
+ - ./mk/ci-setup.sh --check
# Before deps.sh check, not after: muon is a declared hostmakedepends of
# apk-tools but is built here rather than installed from a distribution,
# so the check reports it missing until bootstrap has produced it.
@@ -43,7 +55,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge glibc --pkgver 2.44-r6 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" glibc
- ./mk/build.sh --channel edge glibc
@@ -57,7 +68,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge zlib --pkgver 1.3.1-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" zlib
- ./mk/build.sh --channel edge zlib
@@ -71,7 +81,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge openssl --pkgver 3.5.8-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" openssl
- ./mk/build.sh --channel edge openssl
@@ -85,7 +94,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge linux --pkgver 7.3_rc3-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linux
- ./mk/build.sh --channel edge linux
@@ -103,7 +111,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge apk-tools --pkgver 3.0.8-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" apk-tools
- ./mk/build.sh --channel edge apk-tools
@@ -117,7 +124,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge base-files --pkgver 0.1.0-r6 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" base-files
- ./mk/build.sh --channel edge base-files
@@ -131,7 +137,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge busybox --pkgver 1.36.1-r8 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" busybox
- ./mk/build.sh --channel edge busybox
@@ -148,7 +153,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge curl --pkgver 8.18.0-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" curl
- ./mk/build.sh --channel edge curl
@@ -162,7 +166,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge dosfstools --pkgver 4.2-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" dosfstools
- ./mk/build.sh --channel edge dosfstools
@@ -176,7 +179,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge e2fsprogs --pkgver 1.47.4-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" e2fsprogs
- ./mk/build.sh --channel edge e2fsprogs
@@ -190,7 +192,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge efivar --pkgver 39-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" efivar
- ./mk/build.sh --channel edge efivar
@@ -204,7 +205,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge popt --pkgver 1.19-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" popt
- ./mk/build.sh --channel edge popt
@@ -221,7 +221,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge efibootmgr --pkgver 18-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" efibootmgr
- ./mk/build.sh --channel edge efibootmgr
@@ -235,7 +234,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge libstdc++ --pkgver 14.2.0-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libstdc++
- ./mk/build.sh --channel edge libstdc++
@@ -253,7 +251,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge gptfdisk --pkgver 1.0.10-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" gptfdisk
- ./mk/build.sh --channel edge gptfdisk
@@ -267,7 +264,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge xz --pkgver 5.8.4-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" xz
- ./mk/build.sh --channel edge xz
@@ -283,7 +279,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge grub --pkgver 2.14-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" grub
- ./mk/build.sh --channel edge grub
@@ -297,7 +292,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge libmnl --pkgver 1.0.5-r5 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libmnl
- ./mk/build.sh --channel edge libmnl
@@ -311,7 +305,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge libcap --pkgver 2.78-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libcap
- ./mk/build.sh --channel edge libcap
@@ -328,7 +321,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge iproute2 --pkgver 6.19.0-r3 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" iproute2
- ./mk/build.sh --channel edge iproute2
@@ -342,7 +334,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge linkd --pkgver 0.1.0-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linkd
- ./mk/build.sh --channel edge linkd
@@ -358,7 +349,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge smartmontools --pkgver 7.5-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" smartmontools
- ./mk/build.sh --channel edge smartmontools
@@ -372,7 +362,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge tinyssh --pkgver 20260906-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" tinyssh
- ./mk/build.sh --channel edge tinyssh
@@ -386,7 +375,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge unos-firstboot --pkgver 0.1.0-r2 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" unos-firstboot
- ./mk/build.sh --channel edge unos-firstboot
@@ -400,7 +388,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel edge unos-keys --pkgver 0.1.0-r2 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" unos-keys
- ./mk/build.sh --channel edge unos-keys
@@ -414,7 +401,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts glibc --pkgver 2.44-r6 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" glibc
- ./mk/build.sh --channel lts glibc
@@ -428,7 +414,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts zlib --pkgver 1.3.1-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" zlib
- ./mk/build.sh --channel lts zlib
@@ -442,7 +427,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts openssl --pkgver 3.5.8-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" openssl
- ./mk/build.sh --channel lts openssl
@@ -456,7 +440,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts linux --pkgver 6.18.51-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linux
- ./mk/build.sh --channel lts linux
@@ -474,7 +457,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts apk-tools --pkgver 3.0.8-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" apk-tools
- ./mk/build.sh --channel lts apk-tools
@@ -488,7 +470,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts base-files --pkgver 0.1.0-r6 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" base-files
- ./mk/build.sh --channel lts base-files
@@ -502,7 +483,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts busybox --pkgver 1.36.1-r8 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" busybox
- ./mk/build.sh --channel lts busybox
@@ -519,7 +499,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts curl --pkgver 8.18.0-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" curl
- ./mk/build.sh --channel lts curl
@@ -533,7 +512,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts dosfstools --pkgver 4.2-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" dosfstools
- ./mk/build.sh --channel lts dosfstools
@@ -547,7 +525,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts e2fsprogs --pkgver 1.47.4-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" e2fsprogs
- ./mk/build.sh --channel lts e2fsprogs
@@ -561,7 +538,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts efivar --pkgver 39-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" efivar
- ./mk/build.sh --channel lts efivar
@@ -575,7 +551,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts popt --pkgver 1.19-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" popt
- ./mk/build.sh --channel lts popt
@@ -592,7 +567,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts efibootmgr --pkgver 18-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" efibootmgr
- ./mk/build.sh --channel lts efibootmgr
@@ -606,7 +580,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts libstdc++ --pkgver 14.2.0-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libstdc++
- ./mk/build.sh --channel lts libstdc++
@@ -624,7 +597,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts gptfdisk --pkgver 1.0.10-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" gptfdisk
- ./mk/build.sh --channel lts gptfdisk
@@ -638,7 +610,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts xz --pkgver 5.8.4-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" xz
- ./mk/build.sh --channel lts xz
@@ -654,7 +625,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts grub --pkgver 2.14-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" grub
- ./mk/build.sh --channel lts grub
@@ -668,7 +638,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts libmnl --pkgver 1.0.5-r5 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libmnl
- ./mk/build.sh --channel lts libmnl
@@ -682,7 +651,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts libcap --pkgver 2.78-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libcap
- ./mk/build.sh --channel lts libcap
@@ -699,7 +667,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts iproute2 --pkgver 6.19.0-r3 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" iproute2
- ./mk/build.sh --channel lts iproute2
@@ -713,7 +680,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts linkd --pkgver 0.1.0-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linkd
- ./mk/build.sh --channel lts linkd
@@ -729,7 +695,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts smartmontools --pkgver 7.5-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" smartmontools
- ./mk/build.sh --channel lts smartmontools
@@ -743,7 +708,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts tinyssh --pkgver 20260906-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" tinyssh
- ./mk/build.sh --channel lts tinyssh
@@ -757,7 +721,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts unos-firstboot --pkgver 0.1.0-r2 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" unos-firstboot
- ./mk/build.sh --channel lts unos-firstboot
@@ -771,7 +734,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel lts unos-keys --pkgver 0.1.0-r2 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" unos-keys
- ./mk/build.sh --channel lts unos-keys
@@ -785,7 +747,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable glibc --pkgver 2.44-r6 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" glibc
- ./mk/build.sh --channel stable glibc
@@ -799,7 +760,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable zlib --pkgver 1.3.1-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" zlib
- ./mk/build.sh --channel stable zlib
@@ -813,7 +773,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable openssl --pkgver 3.5.8-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" openssl
- ./mk/build.sh --channel stable openssl
@@ -827,7 +786,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable linux --pkgver 7.2.5-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linux
- ./mk/build.sh --channel stable linux
@@ -845,7 +803,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable apk-tools --pkgver 3.0.8-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" apk-tools
- ./mk/build.sh --channel stable apk-tools
@@ -859,7 +816,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable base-files --pkgver 0.1.0-r6 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" base-files
- ./mk/build.sh --channel stable base-files
@@ -873,7 +829,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable busybox --pkgver 1.36.1-r8 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" busybox
- ./mk/build.sh --channel stable busybox
@@ -890,7 +845,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable curl --pkgver 8.18.0-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" curl
- ./mk/build.sh --channel stable curl
@@ -904,7 +858,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable dosfstools --pkgver 4.2-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" dosfstools
- ./mk/build.sh --channel stable dosfstools
@@ -918,7 +871,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable e2fsprogs --pkgver 1.47.4-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" e2fsprogs
- ./mk/build.sh --channel stable e2fsprogs
@@ -932,7 +884,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable efivar --pkgver 39-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" efivar
- ./mk/build.sh --channel stable efivar
@@ -946,7 +897,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable popt --pkgver 1.19-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" popt
- ./mk/build.sh --channel stable popt
@@ -963,7 +913,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable efibootmgr --pkgver 18-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" efibootmgr
- ./mk/build.sh --channel stable efibootmgr
@@ -977,7 +926,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable libstdc++ --pkgver 14.2.0-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libstdc++
- ./mk/build.sh --channel stable libstdc++
@@ -995,7 +943,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable gptfdisk --pkgver 1.0.10-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" gptfdisk
- ./mk/build.sh --channel stable gptfdisk
@@ -1009,7 +956,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable xz --pkgver 5.8.4-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" xz
- ./mk/build.sh --channel stable xz
@@ -1025,7 +971,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable grub --pkgver 2.14-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" grub
- ./mk/build.sh --channel stable grub
@@ -1039,7 +984,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable libmnl --pkgver 1.0.5-r5 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libmnl
- ./mk/build.sh --channel stable libmnl
@@ -1053,7 +997,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable libcap --pkgver 2.78-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" libcap
- ./mk/build.sh --channel stable libcap
@@ -1070,7 +1013,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable iproute2 --pkgver 6.19.0-r3 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" iproute2
- ./mk/build.sh --channel stable iproute2
@@ -1084,7 +1026,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable linkd --pkgver 0.1.0-r1 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" linkd
- ./mk/build.sh --channel stable linkd
@@ -1100,7 +1041,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable smartmontools --pkgver 7.5-r0 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" smartmontools
- ./mk/build.sh --channel stable smartmontools
@@ -1114,7 +1054,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable tinyssh --pkgver 20260906-r4 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" tinyssh
- ./mk/build.sh --channel stable tinyssh
@@ -1128,7 +1067,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable unos-firstboot --pkgver 0.1.0-r2 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" unos-firstboot
- ./mk/build.sh --channel stable unos-firstboot
@@ -1142,7 +1080,6 @@ tasks:
script:
- ./mk/check-revision.sh --channel stable unos-keys --pkgver 0.1.0-r2 --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/sysroot.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" unos-keys
- ./mk/build.sh --channel stable unos-keys
@@ -1179,7 +1116,6 @@ tasks:
requires: [unos-sign-key]
script:
- ./mk/channel-assemble.sh edge
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/repo-pull.sh --channel edge --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
- ./mk/repo-index.sh --channel edge
@@ -1216,7 +1152,6 @@ tasks:
requires: [unos-sign-key]
script:
- ./mk/channel-assemble.sh lts
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/repo-pull.sh --channel lts --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
- ./mk/repo-index.sh --channel lts
@@ -1253,7 +1188,6 @@ tasks:
requires: [unos-sign-key]
script:
- ./mk/channel-assemble.sh stable
- - ./mk/ci-setup.sh
- ./mk/bootstrap-host.sh
- ./mk/repo-pull.sh --channel stable --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"
- ./mk/repo-index.sh --channel stable
diff --git a/builder/Dockerfile b/builder/Dockerfile
@@ -0,0 +1,10 @@
+# UNOS build toolchain. Bump builder/VERSION whenever this or mk/ci-setup.sh
+# changes, or the pipeline keeps running against the previously pushed tag.
+FROM debian:bookworm-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY mk/ci-setup.sh /tmp/ci-setup.sh
+RUN /tmp/ci-setup.sh --install-only && rm -f /tmp/ci-setup.sh
+
+WORKDIR /work
diff --git a/builder/VERSION b/builder/VERSION
@@ -0,0 +1 @@
+0.1.0
diff --git a/mk/README.md b/mk/README.md
@@ -23,8 +23,24 @@ Promoting a package between channels is a `git mv`, never a copy --
`channel-lint.sh` fails the build on a layer identical to the one it shadows,
because such a layer silently stops tracking its upstream forever.
+## Builder image
+
+Pipeline tasks run on `finwo/unos-builder:<builder/VERSION>` rather than
+installing an apt toolchain per task. `builder/Dockerfile` bakes it by running
+`mk/ci-setup.sh --install-only`, so the image and the toolchain list cannot
+drift apart.
+
+Tags are immutable: `publish-builder.sh` leaves an existing tag alone and
+reports the task skipped. A toolchain change therefore needs a `builder/VERSION`
+bump to take effect, and forgetting that bump is caught by `ci-setup.sh --check`
+in the `check` task, which runs inside the image that was pushed.
+
+Needs the `docker` worker feature and `REGISTRY_USERNAME` / `REGISTRY_TOKEN`
+project variables (`REGISTRY_HOST` for a registry other than Docker Hub).
+
## Files
+- `publish-builder.sh [--dry-run]` -- build and push the builder image.
- `channels.inc` -- chain resolution and repo path layout. Sourced, not run.
- `channel-assemble.sh <channel>` -- compose a channel's package tree.
- `channel-lint.sh` -- reject dead overlays.
diff --git a/mk/ci-setup.sh b/mk/ci-setup.sh
@@ -1,13 +1,13 @@
#!/bin/sh
-# mk/ci-setup.sh - install the build toolchain into an ephemeral CI container.
+# mk/ci-setup.sh - the UNOS build toolchain, install and verify.
#
-# ./mk/ci-setup.sh install, then verify the graph is satisfied
-# ./mk/ci-setup.sh --check verify only, install nothing
+# ./mk/ci-setup.sh install, then verify the graph is satisfied
+# ./mk/ci-setup.sh --check verify only, install nothing
+# ./mk/ci-setup.sh --install-only install only; used to bake builder/Dockerfile
#
-# Pipelines run in a stock debian image with no mounts, so every task starts
-# from nothing and installs what it needs. Keeping that here rather than
-# inlining apt lines in .conductor.yml means one place to change when a
-# template gains a hostmakedepends, and it can verify itself afterwards.
+# builder/Dockerfile runs --install-only so the image and this list cannot
+# drift. Pipeline tasks then run on that image and only --check, which is what
+# catches a template that gained a hostmakedepends without a builder bump.
#
# Two groups, for different reasons:
#
@@ -23,7 +23,13 @@ HERE=$(cd "$(dirname "$0")" && pwd)
ROOT=$(cd "${HERE}/.." && pwd)
CHECK_ONLY=0
-[ "${1:-}" = "--check" ] && CHECK_ONLY=1
+INSTALL_ONLY=0
+case "${1:-}" in
+ --check) CHECK_ONLY=1 ;;
+ --install-only) INSTALL_ONLY=1 ;;
+ "") ;;
+ *) printf 'ci-setup.sh: unknown argument: %s\n' "$1" >&2; exit 1 ;;
+esac
msg() { printf '==> %s\n' "$*"; }
die() { printf 'ci-setup.sh: error: %s\n' "$*" >&2; exit 1; }
@@ -74,6 +80,10 @@ if [ "${CHECK_ONLY}" = "0" ]; then
fi
fi
+# The image is built from mk/ alone; the channel tree it would verify against
+# is not in the build context.
+[ "${INSTALL_ONLY}" = "1" ] && { msg "toolchain installed"; exit 0; }
+
# Verify rather than assume: every hostmakedepends in the graph must now
# resolve. This is what stops the list above silently falling behind a
# template that gained a new build tool.
diff --git a/mk/gen-pipeline.sh b/mk/gen-pipeline.sh
@@ -21,6 +21,12 @@ for c in $(chan_targets); do
[ -d "$(chan_pkgdir "${c}")" ] || "${HERE}/channel-assemble.sh" "${c}" >/dev/null
done
+BUILDER_IMAGE="${UNOS_BUILDER_IMAGE:-finwo/unos-builder}"
+[ -f "${ROOT}/builder/VERSION" ] || { echo "gen-pipeline.sh: no builder/VERSION" >&2; exit 1; }
+read -r BUILDER_VERSION < "${ROOT}/builder/VERSION"
+[ -n "${BUILDER_VERSION}" ] || { echo "gen-pipeline.sh: builder/VERSION is empty" >&2; exit 1; }
+BUILDER_TAG="${BUILDER_IMAGE}:${BUILDER_VERSION}"
+
MODE=print
case "${1:-}" in
--write) MODE=write ;;
@@ -53,7 +59,7 @@ pkgver() {
}
emit() {
- cat <<'HEADER'
+ cat <<HEADER
# GENERATED by mk/gen-pipeline.sh -- do not edit by hand.
#
# Regenerate with: ./mk/gen-pipeline.sh --write
@@ -62,18 +68,30 @@ emit() {
version: 1
defaults:
- image: debian:bookworm-slim
+ image: ${BUILDER_TAG}
timeout: 2h
env:
DEBIAN_FRONTEND: noninteractive
tasks:
+ builder:
+ timeout: 30m
+ arch: [x86_64]
+ image: docker:28-cli
+ requires: [docker]
+ script:
+ - ./mk/publish-builder.sh
+
check:
+ needs:
+ - builder
timeout: 30m
arch: [x86_64]
requires: [unos-sign-key]
script:
- - ./mk/ci-setup.sh
+ # --check, not an install: the toolchain is baked into the builder image,
+ # and this is what fails when a template outgrows it without a bump.
+ - ./mk/ci-setup.sh --check
# Before deps.sh check, not after: muon is a declared hostmakedepends of
# apk-tools but is built here rather than installed from a distribution,
# so the check reports it missing until bootstrap has produced it.
@@ -105,7 +123,6 @@ HEADER
printf ' script:\n'
printf ' - ./mk/check-revision.sh --channel %s %s --pkgver %s --repo "$BUCKET_PUBLIC_URL" || { rc=$?; [ "$rc" = 1 ] && exit 0; exit "$rc"; }\n' "${c}" "$p" "$(pkgver "${c}" "$p")"
printf ' - ./mk/channel-assemble.sh %s\n' "${c}"
- printf ' - ./mk/ci-setup.sh\n'
printf ' - ./mk/bootstrap-host.sh\n'
printf ' - ./mk/sysroot.sh --channel %s --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL" %s\n' "${c}" "$p"
printf ' - ./mk/build.sh --channel %s %s\n' "${c}" "$p"
@@ -127,7 +144,6 @@ HEADER
printf ' requires: [unos-sign-key]\n'
printf ' script:\n'
printf ' - ./mk/channel-assemble.sh %s\n' "${c}"
- printf ' - ./mk/ci-setup.sh\n'
printf ' - ./mk/bootstrap-host.sh\n'
printf ' - ./mk/repo-pull.sh --channel %s --arch "$ARCH" --repo "$BUCKET_PUBLIC_URL"\n' "${c}"
printf ' - ./mk/repo-index.sh --channel %s\n' "${c}"
diff --git a/mk/publish-builder.sh b/mk/publish-builder.sh
@@ -0,0 +1,66 @@
+#!/bin/sh
+# mk/publish-builder.sh - build and push the UNOS builder image.
+#
+# ./mk/publish-builder.sh [--dry-run]
+#
+# Tags are immutable: an existing tag is left alone and the task reports
+# skipped, so a toolchain change needs a builder/VERSION bump to take effect.
+# Forgetting that bump is caught by `ci-setup.sh --check` in the check task,
+# which runs inside the image this pushed.
+set -eu
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+ROOT=$(cd "${HERE}/.." && pwd)
+
+IMAGE="${UNOS_BUILDER_IMAGE:-finwo/unos-builder}"
+DRY=0
+[ "${1:-}" = "--dry-run" ] && DRY=1
+
+msg() { printf '==> %s\n' "$*"; }
+die() { printf 'publish-builder.sh: error: %s\n' "$*" >&2; exit 1; }
+
+[ -f "${ROOT}/builder/VERSION" ] || die "no builder/VERSION"
+read -r VERSION < "${ROOT}/builder/VERSION"
+[ -n "${VERSION}" ] || die "builder/VERSION is empty"
+TAG="${IMAGE}:${VERSION}"
+
+if [ "${DRY}" = "1" ]; then
+ msg "would build and push ${TAG}"
+ exit 0
+fi
+
+command -v docker >/dev/null 2>&1 || die "no docker; task needs requires: [docker]"
+
+published() { docker manifest inspect "${TAG}" >/dev/null 2>&1; }
+
+skip() {
+ msg "${TAG} already published"
+ echo "::set-state skipped"
+ exit 0
+}
+
+# Prevent building if already published
+published && skip
+
+for v in REGISTRY_USERNAME REGISTRY_TOKEN; do
+ eval "val=\${${v}:-}"
+ [ -n "${val}" ] || die "${v} is not set"
+done
+
+logout() { docker logout ${REGISTRY_HOST:+"${REGISTRY_HOST}"} >/dev/null 2>&1 || true; }
+trap logout EXIT INT TERM
+
+printf '%s' "${REGISTRY_TOKEN}" \
+ | docker login --username "${REGISTRY_USERNAME}" --password-stdin ${REGISTRY_HOST:+"${REGISTRY_HOST}"} \
+ || die "docker login failed"
+
+published && skip
+
+msg "building ${TAG}"
+docker build -f "${ROOT}/builder/Dockerfile" -t "${TAG}" "${ROOT}" \
+ || die "docker build failed"
+
+msg "pushing ${TAG}"
+docker push "${TAG}" || die "docker push failed"
+
+msg "published ${TAG}"
diff --git a/tests/unit/test_deps.sh b/tests/unit/test_deps.sh
@@ -91,6 +91,33 @@ done
ntask=$(grep -c '^ pkg-' "${ROOT}/.conductor.yml")
assert_eq "$ntask" "$expected" "no pipeline task outside a published channel"
+# --- builder image -----------------------------------------------------------
+# A stale tag is invisible: tasks keep running on the previously pushed image
+# and only fail once something actually needs the missing tool.
+read -r bver < "${ROOT}/builder/VERSION"
+assert_file_contains "${ROOT}/.conductor.yml" "image: finwo/unos-builder:${bver}" \
+ "pipeline default image matches builder/VERSION"
+
+grep -q '^ builder:' "${ROOT}/.conductor.yml" \
+ || { echo "FAIL: no builder task" >&2; exit 1; }
+echo "PASS: pipeline has a builder task"
+
+grep -q '^ - builder$' "${ROOT}/.conductor.yml" \
+ || { echo "FAIL: check does not depend on builder" >&2; exit 1; }
+echo "PASS: check runs after builder"
+
+# The image bakes the toolchain; installing it again per task is the thing the
+# builder exists to avoid.
+if grep -q -- '- \./mk/ci-setup\.sh$' "${ROOT}/.conductor.yml"; then
+ echo "FAIL: a task installs the toolchain instead of using the builder image" >&2
+ grep -n -- '- \./mk/ci-setup\.sh$' "${ROOT}/.conductor.yml" | head -5 >&2
+ exit 1
+fi
+echo "PASS: no task reinstalls the toolchain"
+
+assert_file_contains "${ROOT}/builder/Dockerfile" "ci-setup.sh --install-only" \
+ "builder image is built from mk/ci-setup.sh, not a copy of its apt list"
+
# The credentials the runner provides, and nothing invented alongside them.
# The rest of the BUCKET_* set is read inside publish.sh and bootstrap-repo.sh,
# which the pipeline calls but does not parameterise.
