53 lines
2.7 KiB
Bash
53 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
# Clusev image-source resolver — sourced by install.sh. Defines functions only; sourcing has no
|
|
# side effects. Decides whether to PULL a digest-pinned promoted image or BUILD locally:
|
|
# env — CLUSEV_IMAGE already set (staging/CI passed it) → respect it, pull.
|
|
# pull — a public release-images.lock names valid image refs → pull exactly those digests.
|
|
# build — no lock (dev/source tree) or an unusable lock → build locally (the tree ships Dockerfile).
|
|
# The result is exposed via the global CLUSEV_RELEASE_MODE + exported CLUSEV_IMAGE/…/CLUSEV_PULL;
|
|
# the caller persists the pin to .env. No file writes here (keeps it unit-testable without root).
|
|
#
|
|
# CLUSEV_RELEASE_MODE is a plain string flag (env|pull|build) read by the caller across the sourcing
|
|
# boundary, so its literal assignments are deliberate and its "use" is external to this file:
|
|
# shellcheck disable=SC2209,SC2034
|
|
|
|
# clusev_json_str FILE KEY -> value of a top-level "KEY": "VALUE" string. jq if present, else sed.
|
|
# The lock is our own single-object JSON, so the sed fallback is sufficient + dependency-free.
|
|
clusev_json_str() {
|
|
local file="$1" key="$2"
|
|
if command -v jq >/dev/null 2>&1; then
|
|
jq -er --arg k "$key" '.[$k] // empty' "$file" 2>/dev/null || true
|
|
else
|
|
sed -n "s/.*\"${key}\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p" "$file" 2>/dev/null | head -n1
|
|
fi
|
|
}
|
|
|
|
# _clusev_ref_ok REF -> true when REF is a plausible registry ref (non-empty, contains a "/" path).
|
|
# Catches an empty/garbage lock so it falls back to a local build instead of a doomed `pull`.
|
|
_clusev_ref_ok() { case "$1" in */*) [ -n "$1" ] ;; *) return 1 ;; esac; }
|
|
|
|
# clusev_resolve_release_images [LOCK] [ENVFILE] -> sets CLUSEV_RELEASE_MODE (env|pull|build) and,
|
|
# on pull/env, exports CLUSEV_PULL (and on pull, CLUSEV_IMAGE/CLUSEV_TERMINAL_IMAGE). ENVFILE is
|
|
# accepted for signature symmetry with the caller but intentionally NOT written here.
|
|
clusev_resolve_release_images() {
|
|
local lock="${1:-release-images.lock}"
|
|
CLUSEV_RELEASE_MODE=build
|
|
# 1) staging/CI already pinned the image via the environment — never override it.
|
|
if [ -n "${CLUSEV_IMAGE:-}" ]; then
|
|
CLUSEV_RELEASE_MODE=env
|
|
export CLUSEV_PULL="${CLUSEV_PULL:-1}"
|
|
return 0
|
|
fi
|
|
# 2) dev/source tree has no lock — build (unchanged).
|
|
[ -f "$lock" ] || return 0
|
|
# 3/4) public tree: pull the exact promoted digests, or build if the lock is unusable.
|
|
local appref termref
|
|
appref="$(clusev_json_str "$lock" app)"
|
|
termref="$(clusev_json_str "$lock" terminal)"
|
|
if _clusev_ref_ok "$appref" && _clusev_ref_ok "$termref"; then
|
|
export CLUSEV_IMAGE="$appref" CLUSEV_TERMINAL_IMAGE="$termref" CLUSEV_PULL=1
|
|
CLUSEV_RELEASE_MODE=pull
|
|
fi
|
|
return 0
|
|
}
|