Add pinned container builds and Wolfskin release signing

docker/gradle.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Run the upstream wrapper with a persistent cache and read-only build credentials.
+set -euo pipefail
+mode=$1
+shift
+root=$(git rev-parse --show-toplevel)
+git_common=$(git rev-parse --path-format=absolute --git-common-dir)
+image=${WOLFSKIN_BUILD_IMAGE:-wolfskin-build:sdk37-jdk21}
+cache=${WOLFSKIN_GRADLE_VOLUME:-wolfskin-gradle}
+secrets=${WOLFSKIN_SECRETS_DIR:-/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin}
+arguments=(--rm --platform linux/amd64 --user "$(id -u):$(id -g)"
+    --mount "type=bind,src=$root,dst=$root" --workdir "$root"
+    --mount "type=volume,src=$cache,dst=/gradle"
+    --mount "type=bind,src=$git_common,dst=$git_common,readonly")
+gradle_arguments=(--no-daemon --console=plain --max-workers=4)
+if [[ $mode == release ]]; then
+    for name in release.jks release.properties github-packages-token; do
+        if [[ ! -s $secrets/$name ]]; then
+            printf 'Missing build credential: %s/%s\n' "$secrets" "$name" >&2
+            exit 1
+        fi
+    done
+    arguments+=(--mount "type=bind,src=$secrets,dst=/run/wolfskin,readonly"
+        --mount "type=bind,src=$root/docker/release-signing.properties,dst=$root/local.properties,readonly")
+    gradle_arguments+=(--init-script /opt/wolfskin/signing.init.gradle)
+    docker run "${arguments[@]}" "$image" bash -euc '
+        export ORG_GRADLE_PROJECT_WholphinExtensionsUsername=JustinZeus
+        export ORG_GRADLE_PROJECT_WholphinExtensionsPassword=$(cat /run/wolfskin/github-packages-token)
+        exec ./gradlew "$@"
+    ' bash "${gradle_arguments[@]}" "$@"
+else
+    docker run "${arguments[@]}" "$image" ./gradlew "${gradle_arguments[@]}" "$@"
+fi