scripts/site-image.sh

Ref: Size: 2.3 KiB History
#!/usr/bin/env bash
# Assemble the eitri.sh webroot and build/push the site image.
#
# Reads deploy.env (same file scripts/deploy.sh uses):
#   SITE_IMAGE      registry/repo to push, e.g. registry.example/eitri-site (required)
#   SITE_PLATFORM   image platform, e.g. linux/arm64 (optional; the Dockerfile
#                   is COPY-only, so cross-building needs no emulation)
#   SITE_DL_VERSION the release /dl serves (optional; defaults to this tree's
#                   version). Pin it to the last release to publish the site
#                   without moving what the fleet downloads: /dl/latest holds
#                   the manifest every agent polls, so an untagged build staged
#                   there would offer itself to every host.
#
# Expects `make release` (dist/<version>) and `make site` (site/dist) to have
# run — the Makefile's site-image target orders all three. Firmware and the
# pinned cloud-hypervisor ship inside dist/<version> itself (see
# scripts/release.sh), so there is nothing extra to stage here.
set -euo pipefail
cd "$(dirname "$0")/.."

ENV_FILE="${EITRI_DEPLOY_ENV:-$HOME/eitri-deploy/deploy.env}"
# shellcheck disable=SC1090
[ -f "$ENV_FILE" ] && . "$ENV_FILE"
: "${SITE_IMAGE:?site-image: set SITE_IMAGE in $ENV_FILE}"

VERSION="$(git describe --tags --always --dirty 2>/dev/null || echo dev)"
DL_VERSION="${SITE_DL_VERSION:-$VERSION}"
[ -d "dist/$DL_VERSION" ] || { echo "site-image: dist/$DL_VERSION missing — run make release" >&2; exit 1; }
[ -f site/dist/index.html ] || { echo "site-image: site/dist missing — run make site" >&2; exit 1; }

# Stage /dl: versioned artifacts + the latest symlink.
rm -rf site/dist/dl/v* site/dist/dl/latest
mkdir -p site/dist/dl
cp -r "dist/$DL_VERSION" "site/dist/dl/$DL_VERSION"
ln -sfn "$DL_VERSION" site/dist/dl/latest

docker build ${SITE_PLATFORM:+--platform "$SITE_PLATFORM"} -f site/Dockerfile -t "$SITE_IMAGE:$VERSION" .
# Between build and push on purpose: the gate is on what gets PUBLISHED. This
# image is the one that needs it — nginx:alpine carries an OS package manifest,
# which is a surface `make vuln` cannot see.
./scripts/scan-image.sh "$SITE_IMAGE:$VERSION"
docker push "$SITE_IMAGE:$VERSION"
echo "site-image: pushed $SITE_IMAGE:$VERSION serving /dl/$DL_VERSION — roll it out on k8s manually"