Denozordec
4db34f94f2
quality / commitlint (push) Skipped
quality / changes (push) Successful in 7s
quality / openapi (push) Successful in 30s
quality / web (push) Successful in 1m1s
quality / api (push) Successful in 1m35s
quality / linux-agent-smoke (push) Failing after 18s
quality / docker-check (push) Failing after 3m28s
CD / quality (push) Failing after 7m1s
CD / publish (push) Skipped
26 lines
1.8 KiB
Bash
26 lines
1.8 KiB
Bash
#!/usr/bin/env sh
|
|
# Stdout is one immutable image reference (or empty for PR/explicit first release).
|
|
# A published baseline is not necessarily the operator's deployed production image.
|
|
set -eu
|
|
previous="${PREVIOUS_IMAGE:-}"
|
|
if [ -n "$previous" ]; then
|
|
printf '%s\n' "$previous" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9._:/-]*@sha256:[0-9a-f]{64}$' || { echo 'EVOFW_PREVIOUS_IMAGE must be an immutable repository@sha256 digest reference' >&2; exit 1; }
|
|
printf '%s\n' "$previous"
|
|
exit 0
|
|
fi
|
|
if [ "${REQUIRE_UPGRADE:-false}" != true ] || [ "${FIRST_RELEASE:-false}" = true ]; then exit 0; fi
|
|
repository="${IMAGE_REPOSITORY:?IMAGE_REPOSITORY required for published upgrade baseline}"
|
|
printf '%s\n' "$repository" | grep -Eq '^[a-z0-9][a-z0-9._:/-]*$' || { echo 'Invalid published image repository' >&2; exit 1; }
|
|
echo 'Resolving the previously published latest image as upgrade baseline; set EVOFW_PREVIOUS_IMAGE to test an explicitly deployed digest instead' >&2
|
|
if ! docker pull "$repository:latest" >&2; then
|
|
echo 'Cannot pull published upgrade baseline. Supply EVOFW_PREVIOUS_IMAGE, or explicitly configure the approved first-release exception; no automatic exception is applied.' >&2
|
|
exit 1
|
|
fi
|
|
digests="$(docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$repository:latest")"
|
|
matches="$(printf '%s\n' "$digests" | awk -v prefix="$repository@" 'index($0,prefix)==1 {print}')"
|
|
count="$(printf '%s\n' "$matches" | awk 'NF {n++} END {print n+0}')"
|
|
[ "$count" = 1 ] || { echo 'Published image must have exactly one matching repository digest; refusing absent, unrelated or ambiguous RepoDigests' >&2; exit 1; }
|
|
digest="${matches#"$repository@"}"
|
|
printf '%s\n' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$' || { echo 'Published image has an invalid repository digest' >&2; exit 1; }
|
|
printf '%s\n' "$repository@$digest"
|