Support sibling Docker daemons in Gitea package builds

packaging/ci.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Copy-based isolation for containerized runners using a sibling Docker daemon.
+set -euo pipefail
+root=$(cd -- "$(dirname -- "$0")/.." && pwd)
+out=$(realpath "${1:?empty output directory outside checkout required}")
+[[ -d $out && -z $(find "$out" -mindepth 1 -print -quit) ]] || exit 1
+case $out in "$root"|"$root"/*) exit 1 ;; esac
+[[ -d $root/.git ]] || exit 1
+image=${G15_BUILD_IMAGE:-g15-packaging}
+build=''
+rebuild=''
+cleanup() {
+    [[ -z $build ]] || docker rm -f "$build" >/dev/null
+    [[ -z $rebuild ]] || docker rm -f "$rebuild" >/dev/null
+}
+trap cleanup EXIT
+docker build -t "$image" -f "$root/packaging/Dockerfile" "$root/packaging"
+build=$(docker create "$image" bash -c 'mkdir /out && shellcheck packaging/*.sh packaging/overlays/v1/*.sh && bash packaging/container-build.sh')
+# Explicit allowlist: never copy editor settings, credentials or unrelated files.
+for path in .git .gitmodules packaging libg15 libg15render g15daemon g15macro g15stats; do
+    docker cp "$root/$path" "$build:/work/$path"
+done
+docker start -a "$build"
+[[ $(docker inspect -f '{{.State.ExitCode}}' "$build") == 0 ]]
+docker cp "$build:/out/." "$out/"
+rebuild=$(docker create "$image" bash -c 'apt-get update && bash /rebuild.sh /out')
+docker cp "$out" "$rebuild:/out"
+docker cp "$root/packaging/rebuild.sh" "$rebuild:/rebuild.sh"
+docker start -a "$rebuild"
+[[ $(docker inspect -f '{{.State.ExitCode}}' "$rebuild") == 0 ]]