agw
aa08dc108e
The README, the publish script and the workflow named the tarball host, its
address and filesystem paths on the web host and the runner. Hosts and paths
now come only from repository variables, and the workflow shares the work
tree and the build cache through the named Docker volumes jasp-build and
jasp-cache instead of host paths. (The runner does not expand ${{ vars }} in
container.volumes, so a variable could not have replaced the host path there.)
Also drop the unused scripts/gen-tarball-index.py, and give each module build
its own process under a time limit: a module once spun for eight hours in
jaspModuleTools' bundling step and stalled the whole build.
Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
65 lines
2.7 KiB
Bash
Executable File
65 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Publish the built tarball to asger.weirsoe.dk, which is what the AUR PKGBUILD
|
|
# downloads from.
|
|
#
|
|
# TARBALL_SSH_KEY private key authorised on the web host (required)
|
|
# TARBALL_HOST web host to upload to over SSH (required)
|
|
# TARBALL_PATH directory on that host (required)
|
|
# KEEP_RELEASES how many tarballs to retain (default 3)
|
|
# $1 path to the tarball to upload
|
|
#
|
|
# TARBALL_PATH is deliberately outside the website's own web root: the site
|
|
# deploy replaces its web root atomically, so anything stored inside it would
|
|
# disappear on the next deploy. The web server publishes the directory through
|
|
# a separate /tarballz/ location.
|
|
|
|
set -euo pipefail
|
|
|
|
TARBALL="${1:?path to tarball is required}"
|
|
: "${TARBALL_SSH_KEY:?TARBALL_SSH_KEY is required}"
|
|
: "${TARBALL_HOST:?TARBALL_HOST is required}"
|
|
: "${TARBALL_PATH:?TARBALL_PATH is required}"
|
|
KEEP_RELEASES="${KEEP_RELEASES:-3}"
|
|
|
|
name="$(basename "$TARBALL")"
|
|
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$TARBALL_SSH_KEY" > ~/.ssh/tarball_key
|
|
chmod 600 ~/.ssh/tarball_key
|
|
ssh-keyscan -t ed25519 "$TARBALL_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
SSH=(ssh -i "$HOME/.ssh/tarball_key" -o StrictHostKeyChecking=accept-new)
|
|
|
|
echo ":: uploading ${name} ($(du -h "$TARBALL" | cut -f1)) to ${TARBALL_HOST}:${TARBALL_PATH}"
|
|
|
|
# Upload to a temporary name and rename on arrival, so a download that starts
|
|
# mid-transfer can never see a truncated file at the final URL.
|
|
"${SSH[@]}" "root@${TARBALL_HOST}" "mkdir -p '${TARBALL_PATH}'"
|
|
"${SSH[@]}" "root@${TARBALL_HOST}" "cat > '${TARBALL_PATH}/.${name}.part'" < "$TARBALL"
|
|
"${SSH[@]}" "root@${TARBALL_HOST}" "mv '${TARBALL_PATH}/.${name}.part' '${TARBALL_PATH}/${name}' && chmod 644 '${TARBALL_PATH}/${name}'"
|
|
|
|
echo ":: verifying the uploaded copy matches"
|
|
local_sum="$(sha256sum "$TARBALL" | awk '{print $1}')"
|
|
remote_sum="$("${SSH[@]}" "root@${TARBALL_HOST}" "sha256sum '${TARBALL_PATH}/${name}'" | awk '{print $1}')"
|
|
if [[ "$local_sum" != "$remote_sum" ]]; then
|
|
echo "error: checksum mismatch after upload" >&2
|
|
echo " local $local_sum" >&2
|
|
echo " remote $remote_sum" >&2
|
|
exit 1
|
|
fi
|
|
echo ":: sha256 matches ($local_sum)"
|
|
|
|
# Old releases are kept so that a user mid-install of the previous version is
|
|
# not left with a dead URL, but not forever - each one is well over a gigabyte.
|
|
echo ":: pruning to the newest ${KEEP_RELEASES} tarballs"
|
|
"${SSH[@]}" "root@${TARBALL_HOST}" "
|
|
cd '${TARBALL_PATH}' || exit 0
|
|
ls -1t jasp-desktop-*.tar.zst 2>/dev/null | tail -n +\$((${KEEP_RELEASES} + 1)) | while read -r old; do
|
|
echo \" removing \$old\"
|
|
rm -f -- \"\$old\"
|
|
done
|
|
echo ' remaining:'
|
|
ls -1sh jasp-desktop-*.tar.zst 2>/dev/null | sed 's/^/ /'
|
|
"
|
|
|
|
echo ":: published"
|