mirror of
https://github.com/authelia/authelia.git
synced 2026-10-28 09:34:52 +08:00
Amir Zarrinkafsh
dc6fb7f5f2
Every agent shares one Docker daemon, and the coverage build used the same `authelia:dist` tag that every suite's `pre-command` loads, retags and removes. When another build's suites loaded their image between this build's `docker build` and the `docker save` in `pre-artifact`, the tag was gone (`reference does not exist`) or pointed at the other build's image. Since `pre-artifact` had no `pipefail`, the failed save uploaded an empty archive, the job passed and every suite in the build failed on load. The coverage image is now built under a per-job tag through a new `--tag` flag on `authelia-scripts docker build`. `pre-artifact` takes `authelia:dist` only to save the archive, inside the same lock the suites hold around their load, and `pre-exit` removes the per-job tag. With every write to `authelia:dist` under that lock, suites can no longer pick up another build's image between their load and retag either. `pre-artifact` now fails the job when the save fails, and skips the save when the build itself failed or was cancelled. Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
34 lines
2.1 KiB
Bash
Executable File
34 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# SPDX-FileCopyrightText: 2026 Authelia
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set +u
|
|
|
|
PROJECT="${COMPOSE_PROJECT_NAME:-authelia}"
|
|
|
|
if [[ ! "${BUILDKITE_COMMAND}" =~ buildkite-agent\ pipeline\ upload ]]; then
|
|
if [[ "${BUILDKITE_AGENT_META_DATA_CLEANBUILD}" != "false" ]]; then
|
|
echo "--- :docker: Clean environment"
|
|
docker images --filter "label=org.authelia.image.prune.protection=true" -q | xargs -r -I{} docker run -d --name "protect_{}" {} sleep infinity; docker system prune -af --volumes; docker ps -aq --filter "name=protect_" | xargs -r docker rm -f
|
|
else
|
|
# The daemon is shared with every other agent on this host, so only this job's own resources may be removed. The
|
|
# agent has to leave the suite network before it can be removed, since a network with an endpoint on it is in use.
|
|
echo "--- :docker: Clean project ${PROJECT}"
|
|
[[ -n "${AGENT_CONTAINER}" ]] && docker network disconnect -f "${PROJECT}_authelianet" "${AGENT_CONTAINER}" 2> /dev/null
|
|
docker ps -aq --filter "label=com.docker.compose.project=${PROJECT}" | xargs -r docker rm -f
|
|
docker volume ls -q --filter "label=com.docker.compose.project=${PROJECT}" | xargs -r docker volume rm -f
|
|
docker network ls -q --filter "label=com.docker.compose.project=${PROJECT}" | xargs -r docker network rm
|
|
docker images --filter "reference=${PROJECT}-*" --format '{{.Repository}}:{{.Tag}}' | xargs -r docker rmi -f > /dev/null 2>&1
|
|
[[ -n "${SUITE_IMAGE}" ]] && docker rmi -f "${SUITE_IMAGE}" > /dev/null 2>&1
|
|
[[ "${BUILDKITE_LABEL}" == ":docker: Build Image [coverage]" ]] && docker rmi -f "authelia:dist-${BUILDKITE_JOB_ID}" > /dev/null 2>&1
|
|
|
|
if [[ "${BUILDKITE_LABEL}" == ":grype: Vulnerability Scanning" ]]; then
|
|
docker images --filter "reference=authelia/authelia:*" --filter "reference=authelia/authelia-cve:*" --format '{{.Repository}}:{{.Tag}}' | xargs -r docker rmi > /dev/null 2>&1
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
sudo find "${SUITE_TMP:-/tmp}/" -mindepth 1 -maxdepth 1 ! -name "buildkite-agent-hook-wrapper*" ! -name "buildkite*" ! -name "job-env-*" -exec rm -rf {} +
|