mirrors/authelia
0
0 Fork 0
mirror of https://github.com/authelia/authelia.git synced 2026-10-28 09:34:52 +08:00
Code Activity
Files
master
authelia/.buildkite/pipeline.sh
T
Amir Zarrinkafsh dc6fb7f5f2 ci(buildkite): stop the coverage build racing suites over its image tag (#13439) 
Every agent shares one Docker daemon, and the coverage build used the
same `authelia:dist` tag that every suite's `pre-command` loads, retags
and removes. When another build's suites loaded their image between this
build's `docker build` and the `docker save` in `pre-artifact`, the tag
was gone (`reference does not exist`) or pointed at the other build's
image. Since `pre-artifact` had no `pipefail`, the failed save uploaded
an empty archive, the job passed and every suite in the build failed on
load.

The coverage image is now built under a per-job tag through a new
`--tag` flag on `authelia-scripts docker build`. `pre-artifact` takes
`authelia:dist` only to save the archive, inside the same lock the
suites hold around their load, and `pre-exit` removes the per-job tag.
With every write to `authelia:dist` under that lock, suites can no
longer pick up another build's image between their load and retag
either.

`pre-artifact` now fails the job when the save fails, and skips the save
when the build itself failed or was cancelled.

Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
2026-10-14 01:54:53 +00:00

265 lines
8.8 KiB
Bash
Executable File
Raw Permalink Blame History

#!/usr/bin/env bash
# SPDX-FileCopyrightText: 2026 Authelia
#
# SPDX-License-Identifier: Apache-2.0
# shellcheck source=/dev/null
source "$(dirname "${BASH_SOURCE[0]}")/libs/common.sh"
BYPASS_REGEX='/^(CODE_OF_CONDUCT\.md|CONTRIBUTING\.md|README\.md|SECURITY\.md|crowdin\.yml|\.all-contributorsrc|\.editorconfig|\.github\/.*|docs\/.*|cmd\/authelia-gen\/templates\/.*|examples\/.*)/!{q1}'
BUILD_DUO="false"
BUILD_HAPROXY="false"
BUILD_OIDCCONFORMANCE="false"
BUILD_SAMBA="false"
CI_BYPASS="false"
CI_MERGE_QUEUE="false"
CI_MERGE_QUEUE_BYPASS="false"
CI_PRIVATE="false"
LINT_REPORTER="github-check"
resolve_base_ref
if [[ "${BASE_REF_OK}" == "true" ]] && [[ "${BUILDKITE_TAG}" == "" ]]; then
changed "${BASE_REF}" "internal/suites/example/compose/duo-api/Dockerfile" && BUILD_DUO="true"
changed "${BASE_REF}" "internal/suites/example/compose/haproxy/Dockerfile" && BUILD_HAPROXY="true"
changed "${BASE_REF}" "internal/suites/example/compose/oidc-conformance/Dockerfile" && BUILD_OIDCCONFORMANCE="true"
changed "${BASE_REF}" "internal/suites/example/compose/oidc-conformance/authelia-login.patch" && BUILD_OIDCCONFORMANCE="true"
changed "${BASE_REF}" "internal/suites/common/pki/ca.public.crt" && BUILD_OIDCCONFORMANCE="true"
changed "${BASE_REF}" "internal/suites/example/compose/samba/Dockerfile" && BUILD_SAMBA="true"
CI_BYPASS=$(bypass_check "${BASE_REF}" "${BYPASS_REGEX}")
if [[ ${CI_BYPASS} == "true" ]]; then
buildkite-agent annotate --style "info" --context "ctx-info" < .buildkite/annotations/bypass
fi
fi
if [[ ${BUILDKITE_PULL_REQUEST_DRAFT} == "true" ]] && [[ ${BUILDKITE_BRANCH} =~ ^(dependabot|renovate) ]]; then
CI_BYPASS="true"
buildkite-agent annotate --style "info" --context "ctx-info" < .buildkite/annotations/draft
fi
if [[ ${BUILDKITE_BRANCH} =~ ^gh-readonly-queue/.* ]]; then
CI_BYPASS="true"
CI_MERGE_QUEUE="true"
CI_MERGE_QUEUE_BYPASS=$(bypass_check "HEAD^..HEAD" "${BYPASS_REGEX}")
buildkite-agent annotate --style "info" --context "ctx-info" < .buildkite/annotations/merge-queue
fi
if [[ ${BUILDKITE_PIPELINE_SLUG} == "authelia-cve" ]]; then
CI_PRIVATE="true"
LINT_REPORTER="local"
fi
cat << EOF
env:
BUILD_DUO: ${BUILD_DUO}
BUILD_HAPROXY: ${BUILD_HAPROXY}
BUILD_OIDCCONFORMANCE: ${BUILD_OIDCCONFORMANCE}
BUILD_SAMBA: ${BUILD_SAMBA}
CI_BYPASS: ${CI_BYPASS}
CI_MERGE_QUEUE: ${CI_MERGE_QUEUE}
CI_MERGE_QUEUE_BYPASS: ${CI_MERGE_QUEUE_BYPASS}
CI_PRIVATE: ${CI_PRIVATE}
steps:
- group: ":hammer_and_wrench: Lint, Unit Test and Build"
steps:
- label: ":service_dog: Linting"
command: "CI_PULL_REQUEST= lint.sh -reporter=${LINT_REPORTER} -filter-mode=nofilter -fail-level=error -fail-on-error"
if: build.branch !~ /^(v[0-9]+\.[0-9]+\.[0-9]+)$\$/ && build.message !~ /\[(skip test|test skip)\]/
- label: ":hammer_and_wrench: Unit Test"
command: "authelia-scripts --log-level debug ci --buildkite"
agents:
build: "unit-test"
artifact_paths:
- "*.tar.gz"
- "*.deb"
- "*.sha256"
- "*.sig"
- "*.{c,sp}dx.json"
key: "unit-test"
env:
NODE_OPTIONS: "--no-deprecation"
if: build.env("CI_BYPASS") != "true"
- label: ":docker: Build Image [coverage]"
command: "authelia-scripts docker build --container=coverage --tag=authelia:dist-\$\${BUILDKITE_JOB_ID}"
retry:
manual:
permit_on_passed: true
agents:
build: "linux-coverage"
artifact_paths:
- "authelia-image-coverage.tar.zst"
key: "build-docker-linux-coverage"
if: build.branch !~ /^(v[0-9]+\.[0-9]+\.[0-9]+)$\$/ && build.env("CI_BYPASS") != "true" && build.message !~ /\[(skip test|test skip)\]/
- label: ":grype: Vulnerability Scanning"
command: "grypescans.sh"
EOF
if [[ ${CI_MERGE_QUEUE} != "true" ]]; then
cat << EOF
depends_on:
- "unit-test"
- "build-docker-linux"
if: build.env("CI_BYPASS") != "true" && build.message !~ /^docs/
EOF
else
cat << EOF
if: build.env("CI_MERGE_QUEUE_BYPASS") != "true"
EOF
fi
if [[ ${BUILDKITE_TAG} != "" ]]; then
cat << EOF
- label: ":rocket: Trigger Pipeline [baseimage]"
trigger: "baseimage"
build:
message: "${BUILDKITE_MESSAGE%%$'\n'*}"
env:
AUTHELIA_RELEASE: "${BUILDKITE_TAG//v}"
BUILDKITE_PULL_REQUEST: "${BUILDKITE_PULL_REQUEST}"
BUILDKITE_PULL_REQUEST_BASE_BRANCH: "${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
BUILDKITE_PULL_REQUEST_REPO: "${BUILDKITE_PULL_REQUEST_REPO}"
key: "baseimage"
if: build.tag != null && build.env("CI_BYPASS") != "true"
EOF
fi
if [[ ${CI_BYPASS} != "true" ]]; then
if [[ ${BUILD_DUO} == "true" ]]; then
cat << EOF
- label: ":rocket: Trigger Pipeline [integration-duo]"
trigger: "integration-duo"
key: "integration-duo"
build:
message: "${BUILDKITE_MESSAGE%%$'\n'*}"
commit: "${BUILDKITE_COMMIT}"
branch: "${BUILDKITE_BRANCH}"
env:
BUILDKITE_PULL_REQUEST: "${BUILDKITE_PULL_REQUEST}"
BUILDKITE_PULL_REQUEST_BASE_BRANCH: "${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
BUILDKITE_PULL_REQUEST_REPO: "${BUILDKITE_PULL_REQUEST_REPO}"
EOF
fi
if [[ ${BUILD_HAPROXY} == "true" ]]; then
cat << EOF
- label: ":rocket: Trigger Pipeline [integration-haproxy]"
trigger: "integration-haproxy"
key: "integration-haproxy"
build:
message: "${BUILDKITE_MESSAGE%%$'\n'*}"
commit: "${BUILDKITE_COMMIT}"
branch: "${BUILDKITE_BRANCH}"
env:
BUILDKITE_PULL_REQUEST: "${BUILDKITE_PULL_REQUEST}"
BUILDKITE_PULL_REQUEST_BASE_BRANCH: "${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
BUILDKITE_PULL_REQUEST_REPO: "${BUILDKITE_PULL_REQUEST_REPO}"
EOF
fi
if [[ ${BUILD_OIDCCONFORMANCE} == "true" ]]; then
cat << EOF
- label: ":rocket: Trigger Pipeline [integration-oidcconformance]"
trigger: "integration-oidcconformance"
key: "integration-oidcconformance"
build:
message: "${BUILDKITE_MESSAGE%%$'\n'*}"
commit: "${BUILDKITE_COMMIT}"
branch: "${BUILDKITE_BRANCH}"
env:
BUILDKITE_PULL_REQUEST: "${BUILDKITE_PULL_REQUEST}"
BUILDKITE_PULL_REQUEST_BASE_BRANCH: "${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
BUILDKITE_PULL_REQUEST_REPO: "${BUILDKITE_PULL_REQUEST_REPO}"
EOF
fi
if [[ ${BUILD_SAMBA} == "true" ]]; then
cat << EOF
- label: ":rocket: Trigger Pipeline [integration-samba]"
trigger: "integration-samba"
key: "integration-samba"
build:
message: "${BUILDKITE_MESSAGE%%$'\n'*}"
commit: "${BUILDKITE_COMMIT}"
branch: "${BUILDKITE_BRANCH}"
env:
BUILDKITE_PULL_REQUEST: "${BUILDKITE_PULL_REQUEST}"
BUILDKITE_PULL_REQUEST_BASE_BRANCH: "${BUILDKITE_PULL_REQUEST_BASE_BRANCH}"
BUILDKITE_PULL_REQUEST_REPO: "${BUILDKITE_PULL_REQUEST_REPO}"
EOF
fi
fi
cat << EOF
- group: ":test_tube: Tests"
steps:
- label: ":buildkite: Integration Tests"
command: "e2etests.sh | buildkite-agent pipeline upload"
depends_on:
- "build-docker-linux-coverage"
if: build.branch !~ /^(v[0-9]+\.[0-9]+\.[0-9]+)$\$/ && build.env("CI_BYPASS") != "true" && build.message !~ /\[(skip test|test skip)\]/
- group: ":test_tube: External Tests"
steps:
- label: ":buildkite: External Tests"
command: "e2epackages.sh | buildkite-agent pipeline upload"
if: build.branch !~ /^(v[0-9]+\.[0-9]+\.[0-9]+)$\$/ && build.message !~ /\[(skip test|test skip)\]/ && build.env("CI_MERGE_QUEUE") != "true"
- group: ":rocket: Deploy"
steps:
- label: ":docker: Deploy Manifest"
command: "authelia-scripts docker push-manifest"
depends_on:
- "unit-test"
EOF
if [[ "${BUILDKITE_TAG}" != "" ]]; then
cat << EOF
- "baseimage"
EOF
fi
cat << EOF
retry:
manual:
permit_on_passed: true
agents:
upload: "fast"
key: "build-docker-linux"
EOF
if [[ ${BUILDKITE_BRANCH} == "master" ]]; then
cat << EOF
concurrency: 1
concurrency_group: "deployments"
EOF
fi
cat << EOF
if: build.env("CI_BYPASS") != "true" && build.message !~ /^docs/
- label: ":github: Deploy Artifacts"
command: "ghartifacts.sh"
depends_on:
- "unit-test"
retry:
automatic: true
agents:
upload: "fast"
key: "artifacts"
if: build.tag != null && build.env("CI_BYPASS") != "true" && build.env("CI_PRIVATE") != "true"
- label: ":buildkite: Deploy AUR"
command: "aurpackages.sh | buildkite-agent pipeline upload"
if: build.tag != null && build.env("CI_BYPASS") != "true" && build.env("CI_PRIVATE") != "true"
- label: ":debian: :fedora: :ubuntu: Deploy APT"
command: "aptdeploy.sh"
depends_on:
- "unit-test"
agents:
upload: "fast"
if: build.tag != null && build.env("CI_BYPASS") != "true" && build.env("CI_PRIVATE") != "true"
EOF
View Git Blame Copy Permalink