g15keyboard/packaging/run.sh

#!/bin/bash
# Host orchestration: no package installation or generated source in workspace.
set -euo pipefail
root=$(cd -- "$(dirname -- "$0")/.." && pwd)
out=$(realpath "${1:?create an empty output directory outside the checkout}")
[[ -d $out && -z $(find "$out" -mindepth 1 -print -quit) ]] || exit 1
case $out in "$root"|"$root"/*) echo 'Output must be outside the checkout' >&2; exit 1 ;; esac
[[ -d $root/.git ]] || { echo 'Regular clone required (external gitdirs unsupported)' >&2; exit 1; }
image=${G15_BUILD_IMAGE:-g15-packaging}
docker build -t "$image" -f "$root/packaging/Dockerfile" "$root/packaging"
# Allowlist mounts: .vscode and other unrelated local files are not exposed.
mounts=()
for path in .git .gitmodules packaging libg15 libg15render g15daemon g15macro g15stats; do
    mounts+=(--mount "type=bind,src=$root/$path,dst=/work/$path,readonly")
done
docker run --rm "${mounts[@]}" --mount "type=bind,src=$out,dst=/out" "$image"
docker run --rm --mount "type=bind,src=$out,dst=/out,readonly" \
    --mount "type=bind,src=$root/packaging/rebuild.sh,dst=/rebuild.sh,readonly" \
    "$image" bash -c 'apt-get update && bash /rebuild.sh /out'