30 lines
1.4 KiB
Bash
30 lines
1.4 KiB
Bash
|
#!/bin/bash
|
||
|
|
# Copy-based isolation for containerized runners using a sibling Docker daemon.
|
||
|
|
set -euo pipefail
|
||
|
|
root=$(cd -- "$(dirname -- "$0")/.." && pwd)
|
||
|
|
out=$(realpath "${1:?empty output directory outside checkout required}")
|
||
|
|
[[ -d $out && -z $(find "$out" -mindepth 1 -print -quit) ]] || exit 1
|
||
|
|
case $out in "$root"|"$root"/*) exit 1 ;; esac
|
||
|
|
[[ -d $root/.git ]] || exit 1
|
||
|
|
image=${G15_BUILD_IMAGE:-g15-packaging}
|
||
|
|
build=''
|
||
|
|
rebuild=''
|
||
|
|
cleanup() {
|
||
|
|
[[ -z $build ]] || docker rm -f "$build" >/dev/null
|
||
|
|
[[ -z $rebuild ]] || docker rm -f "$rebuild" >/dev/null
|
||
|
|
}
|
||
|
|
trap cleanup EXIT
|
||
|
|
docker build -t "$image" -f "$root/packaging/Dockerfile" "$root/packaging"
|
||
|
|
build=$(docker create "$image" bash -c 'mkdir /out && shellcheck packaging/*.sh packaging/overlays/v1/*.sh && bash packaging/container-build.sh')
|
||
|
|
# Explicit allowlist: never copy editor settings, credentials or unrelated files.
|
||
|
|
for path in .git .gitmodules packaging libg15 libg15render g15daemon g15macro g15stats; do
|
||
|
|
docker cp "$root/$path" "$build:/work/$path"
|
||
|
|
done
|
||
|
|
docker start -a "$build"
|
||
|
|
[[ $(docker inspect -f '{{.State.ExitCode}}' "$build") == 0 ]]
|
||
|
|
docker cp "$build:/out/." "$out/"
|
||
|
|
rebuild=$(docker create "$image" bash -c 'apt-get update && bash /rebuild.sh /out')
|
||
|
|
docker cp "$out" "$rebuild:/out"
|
||
|
|
docker cp "$root/packaging/rebuild.sh" "$rebuild:/rebuild.sh"
|
||
|
|
docker start -a "$rebuild"
|
||
|
|
[[ $(docker inspect -f '{{.State.ExitCode}}' "$rebuild") == 0 ]]
|