justinzeus
221f623c87
All checks were successful
review/code-claude Approve: lock held across container, no deadlock, releases on all exits
39 lines
1.9 KiB
Bash
Executable file
39 lines
1.9 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Run the upstream wrapper with a persistent cache and read-only build credentials.
|
|
set -euo pipefail
|
|
mode=$1
|
|
shift
|
|
root=$(git rev-parse --show-toplevel)
|
|
git_common=$(git rev-parse --path-format=absolute --git-common-dir)
|
|
image=${WOLFSKIN_BUILD_IMAGE:-wolfskin-build:sdk37-jdk21}
|
|
cache=${WOLFSKIN_GRADLE_VOLUME:-wolfskin-gradle}
|
|
secrets=${WOLFSKIN_SECRETS_DIR:-/opt/stacks/ventoy/machine-parity/manifest-tank/secrets/wolfskin}
|
|
lock=${WOLFSKIN_GRADLE_LOCK_FILE:-/var/tmp/${cache}.gradle.lock}
|
|
exec {lock_fd}>"$lock"
|
|
if ! flock --exclusive --nonblock "$lock_fd"; then
|
|
printf 'Waiting for Gradle cache lock: %s\n' "$lock" >&2
|
|
flock --exclusive "$lock_fd"
|
|
fi
|
|
arguments=(--rm --platform linux/amd64 --user "$(id -u):$(id -g)"
|
|
--mount "type=bind,src=$root,dst=$root" --workdir "$root"
|
|
--mount "type=volume,src=$cache,dst=/gradle"
|
|
--mount "type=bind,src=$git_common,dst=$git_common,readonly")
|
|
gradle_arguments=(--no-daemon --console=plain --max-workers=4)
|
|
if [[ $mode == release ]]; then
|
|
for name in release.jks release.properties github-packages-token; do
|
|
if [[ ! -s $secrets/$name ]]; then
|
|
printf 'Missing build credential: %s/%s\n' "$secrets" "$name" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
arguments+=(--mount "type=bind,src=$secrets,dst=/run/wolfskin,readonly"
|
|
--mount "type=bind,src=$root/docker/release-signing.properties,dst=$root/local.properties,readonly")
|
|
gradle_arguments+=(--init-script /opt/wolfskin/signing.init.gradle)
|
|
docker run "${arguments[@]}" "$image" bash -euc '
|
|
export ORG_GRADLE_PROJECT_WholphinExtensionsUsername=JustinZeus
|
|
export ORG_GRADLE_PROJECT_WholphinExtensionsPassword=$(cat /run/wolfskin/github-packages-token)
|
|
exec ./gradlew "$@"
|
|
' bash "${gradle_arguments[@]}" "$@"
|
|
else
|
|
docker run "${arguments[@]}" "$image" ./gradlew "${gradle_arguments[@]}" "$@"
|
|
fi
|