justinzeus
556d633e88
All checks were successful
review/code-gpt Build-script only (docker/gradle.sh + README): persistent debug keystore outside the checkout, readonly bind-mount, fails loudly; firstmate read the diff; lane showed identical signer SHA-256 across two optimized builds and the debug build
70 lines
3.4 KiB
Bash
Executable file
70 lines
3.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Run the upstream wrapper with a persistent cache and read-only build credentials.
|
|
set -euo pipefail
|
|
mode=$1
|
|
shift
|
|
root=$(git rev-parse --show-toplevel)
|
|
git_common=$(git rev-parse --path-format=absolute --git-common-dir)
|
|
image=${WOLFSKIN_BUILD_IMAGE:-wolfskin-build:sdk37-jdk21}
|
|
cache=${WOLFSKIN_GRADLE_VOLUME:-wolfskin-gradle}
|
|
secrets=${WOLFSKIN_SECRETS_DIR:-/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin}
|
|
lock=${WOLFSKIN_GRADLE_LOCK_FILE:-/var/tmp/${cache}.gradle.lock}
|
|
exec {lock_fd}>"$lock"
|
|
if ! flock --exclusive --nonblock "$lock_fd"; then
|
|
printf 'Waiting for Gradle cache lock: %s\n' "$lock" >&2
|
|
flock --exclusive "$lock_fd"
|
|
fi
|
|
arguments=(--rm --platform linux/amd64 --user "$(id -u):$(id -g)"
|
|
--mount "type=bind,src=$root,dst=$root" --workdir "$root"
|
|
--mount "type=volume,src=$cache,dst=/gradle"
|
|
--mount "type=bind,src=$git_common,dst=$git_common,readonly")
|
|
gradle_arguments=(--no-daemon --console=plain --max-workers=4)
|
|
if [[ $mode == release ]]; then
|
|
for name in release.jks release.properties github-packages-token; do
|
|
if [[ ! -s $secrets/$name ]]; then
|
|
printf 'Missing build credential: %s/%s\n' "$secrets" "$name" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
arguments+=(--mount "type=bind,src=$secrets,dst=/run/wolfskin,readonly"
|
|
--mount "type=bind,src=$root/docker/release-signing.properties,dst=$root/local.properties,readonly")
|
|
gradle_arguments+=(--init-script /opt/wolfskin/signing.init.gradle)
|
|
docker run "${arguments[@]}" "$image" bash -euc '
|
|
export ORG_GRADLE_PROJECT_WholphinExtensionsUsername=JustinZeus
|
|
export ORG_GRADLE_PROJECT_WholphinExtensionsPassword=$(cat /run/wolfskin/github-packages-token)
|
|
exec ./gradlew "$@"
|
|
' bash "${gradle_arguments[@]}" "$@"
|
|
else
|
|
debug_keystore=$(realpath -m "${WOLFSKIN_DEBUG_KEYSTORE:-/root/.treehouse/firstmate-7bab20/2/firstmate/data/signing/debug.keystore}")
|
|
case "$debug_keystore" in
|
|
"$root"|"$root"/*)
|
|
printf 'Debug keystore must be outside the checkout: %s\n' "$debug_keystore" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
signing_directory=$(dirname "$debug_keystore")
|
|
mkdir -p "$signing_directory"
|
|
chmod 700 "$signing_directory"
|
|
if [[ ! -e $debug_keystore ]]; then
|
|
temporary_directory=$(mktemp -d "$signing_directory/.debug-keystore.XXXXXX")
|
|
trap 'rm -rf -- "$temporary_directory"' EXIT
|
|
if ! docker run --rm --platform linux/amd64 --user "$(id -u):$(id -g)" \
|
|
--mount "type=bind,src=$temporary_directory,dst=/run/signing" \
|
|
"$image" keytool -genkeypair -noprompt -keystore /run/signing/debug.keystore \
|
|
-storetype JKS -storepass android -keypass android -alias androiddebugkey \
|
|
-keyalg RSA -keysize 2048 -validity 10000 -dname "CN=Android Debug"; then
|
|
printf 'Failed to generate persistent debug keystore: %s\n' "$debug_keystore" >&2
|
|
exit 1
|
|
fi
|
|
chmod 600 "$temporary_directory/debug.keystore"
|
|
mv "$temporary_directory/debug.keystore" "$debug_keystore"
|
|
fi
|
|
if [[ ! -s $debug_keystore ]]; then
|
|
printf 'Missing or empty persistent debug keystore: %s\n' "$debug_keystore" >&2
|
|
exit 1
|
|
fi
|
|
chmod 600 "$debug_keystore"
|
|
arguments+=(--env ANDROID_USER_HOME=/tmp/.android
|
|
--mount "type=bind,src=$debug_keystore,dst=/tmp/.android/debug.keystore,readonly")
|
|
docker run "${arguments[@]}" "$image" ./gradlew "${gradle_arguments[@]}" "$@"
|
|
fi
|