build(release)!: retire legacy paths and consume snapshots

.github/release-parity/targets.json

@@ -74,24 +74,12 @@
       "radiusBuild": true,
       "requiredPlatforms": ["linux/amd64", "linux/arm/v7", "linux/arm64"]
     },
-    {
-      "category": "test",
-      "name": "magpiego",
-      "radiusBuild": true,
-      "requiredPlatforms": ["linux/amd64", "linux/arm/v7", "linux/arm64"]
-    },
     {
       "category": "production",
       "name": "pre-upgrade",
       "radiusBuild": true,
       "requiredPlatforms": ["linux/amd64", "linux/arm/v7", "linux/arm64"]
     },
-    {
-      "category": "test",
-      "name": "testrp",
-      "radiusBuild": true,
-      "requiredPlatforms": ["linux/amd64", "linux/arm/v7", "linux/arm64"]
-    },
     {
       "category": "production",
       "name": "ucpd",

.github/scripts/goreleaser-snapshot-artifacts.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly SCRIPT_DIR
+readonly DIST_DIR="${GORELEASER_DIST_DIR:-dist/goreleaser}"
+readonly TARGETS="${RELEASE_PARITY_TARGETS:-${SCRIPT_DIR}/../release-parity/targets.json}"
+readonly REGISTRY="${DOCKER_REGISTRY:?DOCKER_REGISTRY is required}"
+readonly TAG="${DOCKER_TAG_VERSION:?DOCKER_TAG_VERSION is required}"
+readonly IMAGES_DIR="${SNAPSHOT_IMAGES_DIR:-dist/images}"
+readonly MODE="${1:?Expected save or push-edge}"
+
+case "${MODE}" in
+    save) ;;
+    push-edge)
+        [[ "${TAG}" == edge ]] || {
+            echo "push-edge publishes only the edge tag" >&2
+            exit 1
+        }
+        ;;
+    *)
+        echo "Expected save or push-edge" >&2
+        exit 1
+        ;;
+esac
+
+version="$(jq -er '.version' "${DIST_DIR}/metadata.json")"
+[[ "${version}" =~ ^0\.0\.0-snapshot-[a-f0-9]+$ ]] || {
+    echo "Expected GoReleaser snapshot metadata" >&2
+    exit 1
+}
+
+jq -e --slurpfile targets "${TARGETS}" --arg registry "${REGISTRY}" --arg version "${version}" '
+    [.[] | select(.type == "Docker Image")] as $images |
+    [$targets[0].images[] | select(.category == "production") |
+        .name as $id | .requiredPlatforms[] | {id: $id, platform: .}] as $expected |
+    ($images | length > 0) and
+    ([$images[] | {id: .extra.ID, platform: .extra.Platforms[0]}] | sort) == ($expected | sort) and
+    all($images[]; . as $image |
+        (.extra.Platforms | length == 1) and .name == .path and
+        (.name | startswith($registry + "/" + $image.extra.ID + ":" + $version + "-")))
+' "${DIST_DIR}/artifacts.json" >/dev/null
+
+mkdir -p "${IMAGES_DIR}"
+mapfile -t image_ids < <(jq -r '[.[] | select(.type == "Docker Image") | .extra.ID] | unique[]' "${DIST_DIR}/artifacts.json")
+for image_id in "${image_ids[@]}"; do
+    mapfile -t images < <(jq -r --arg id "${image_id}" '
+        .[] | select(.type == "Docker Image" and .extra.ID == $id) | .path
+    ' "${DIST_DIR}/artifacts.json")
+    if [[ "${MODE}" == save ]]; then
+        native_image="$(jq -er --arg id "${image_id}" '
+            .[] | select(.type == "Docker Image" and .extra.ID == $id and .extra.Platforms == ["linux/amd64"]) | .path
+        ' "${DIST_DIR}/artifacts.json")"
+        docker tag "${native_image}" "${REGISTRY}/${image_id}:${TAG}"
+        docker save --output "${IMAGES_DIR}/${image_id}.tar" "${images[@]}" "${REGISTRY}/${image_id}:${TAG}"
+    else
+        sources=()
+        for image in "${images[@]}"; do
+            platform="$(jq -er --arg path "${image}" '
+                .[] | select(.type == "Docker Image" and .path == $path) | .extra.Platforms[0]
+            ' "${DIST_DIR}/artifacts.json")"
+            # A moving per-platform tag replaces one set of snapshot-version tags
+            # per main build; the edge index references the manifests by digest.
+            reference="${REGISTRY}/${image_id}:edge-${platform//\//-}"
+            docker tag "${image}" "${reference}"
+            docker push "${reference}"
+            digest="$(oras resolve "${reference}")"
+            [[ "${digest}" =~ ^sha256:[a-f0-9]{64}$ ]] || exit 1
+            sources+=("${REGISTRY}/${image_id}@${digest}")
+        done
+        docker buildx imagetools create --tag "${REGISTRY}/${image_id}:edge" "${sources[@]}"
+    fi
+done

.github/scripts/goreleaser-snapshot-artifacts_test.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEST_ROOT="$(mktemp -d)"
+readonly SCRIPT_DIR TEST_ROOT
+trap 'rm -rf "${TEST_ROOT}"' EXIT
+export GORELEASER_DIST_DIR="${TEST_ROOT}/snapshot"
+export SNAPSHOT_IMAGES_DIR="${TEST_ROOT}/images"
+export DOCKER_REGISTRY=registry.example/radius
+export DOCKER_TAG_VERSION=pr-123
+export COMMAND_LOG="${TEST_ROOT}/commands"
+mkdir -p "${GORELEASER_DIST_DIR}" "${TEST_ROOT}/bin"
+printf '%s\n' '{"version":"0.0.0-snapshot-0123456"}' >"${GORELEASER_DIST_DIR}/metadata.json"
+jq '[.images[] | select(.category == "production") | .name as $id | .requiredPlatforms[] |
+    ("registry.example/radius/" + $id + ":0.0.0-snapshot-0123456-" + gsub("/"; "-")) as $name |
+    {type: "Docker Image", name: $name, path: $name, extra: {ID: $id, Platforms: [.]}}]
+' "${SCRIPT_DIR}/../release-parity/targets.json" >"${GORELEASER_DIST_DIR}/artifacts.json"
+cp "${GORELEASER_DIST_DIR}/artifacts.json" "${TEST_ROOT}/complete.json"
+cat >"${TEST_ROOT}/bin/docker" <<'EOF'
+#!/bin/bash
+set -euo pipefail
+printf 'docker %s\n' "$*" >>"${COMMAND_LOG}"
+[[ "${FAIL_PUSH:-false}" != true || "$1" != push ]]
+EOF
+cat >"${TEST_ROOT}/bin/oras" <<'EOF'
+#!/bin/bash
+set -euo pipefail
+[[ "$1" == resolve ]]
+printf 'oras %s\n' "$*" >>"${COMMAND_LOG}"
+printf 'sha256:%064d\n' 1
+EOF
+chmod +x "${TEST_ROOT}/bin/"*
+export PATH="${TEST_ROOT}/bin:${PATH}"
+
+bash "${SCRIPT_DIR}/goreleaser-snapshot-artifacts.sh" save
+[[ "$(grep -c '^docker save ' "${COMMAND_LOG}")" == 5 ]]
+[[ "$(grep -c '^docker tag ' "${COMMAND_LOG}")" == 5 ]]
+grep -Fq 'registry.example/radius/ucpd:pr-123' "${COMMAND_LOG}"
+if grep -Eq 'push|buildx|latest|testrp|magpiego' "${COMMAND_LOG}"; then exit 1; fi
+
+: >"${COMMAND_LOG}"
+DOCKER_TAG_VERSION=edge bash "${SCRIPT_DIR}/goreleaser-snapshot-artifacts.sh" push-edge
+[[ "$(grep -c '^docker push ' "${COMMAND_LOG}")" == 15 ]]
+[[ "$(grep -c '^docker tag .* registry.example/radius/[a-z-]*:edge-linux-' "${COMMAND_LOG}")" == 15 ]]
+grep -Eq '^docker push registry.example/radius/ucpd:edge-linux-arm-v7$' "${COMMAND_LOG}"
+if grep -Eq '^docker push .*0.0.0-snapshot' "${COMMAND_LOG}"; then exit 1; fi
+[[ "$(grep -c '^docker buildx imagetools create ' "${COMMAND_LOG}")" == 5 ]]
+grep -Eq '^docker buildx imagetools create --tag registry.example/radius/ucpd:edge( registry.example/radius/ucpd@sha256:[a-f0-9]{64}){3}$' "${COMMAND_LOG}"
+if grep -Eq ':latest|:0\.[0-9]+ |testrp|magpiego' "${COMMAND_LOG}"; then exit 1; fi
+
+for mutation in '.[1:]' '. + [.[0]]' '.[0].extra.Platforms = ["linux/386"]' '.[0].path = "unexpected/image:tag"'; do
+    jq "${mutation}" "${TEST_ROOT}/complete.json" >"${GORELEASER_DIST_DIR}/artifacts.json"
+    : >"${COMMAND_LOG}"
+    if bash "${SCRIPT_DIR}/goreleaser-snapshot-artifacts.sh" save; then exit 1; fi
+    [[ ! -s "${COMMAND_LOG}" ]]
+done
+cp "${TEST_ROOT}/complete.json" "${GORELEASER_DIST_DIR}/artifacts.json"
+: >"${COMMAND_LOG}"
+if DOCKER_TAG_VERSION=edge FAIL_PUSH=true bash "${SCRIPT_DIR}/goreleaser-snapshot-artifacts.sh" push-edge; then exit 1; fi
+if grep -q 'imagetools create' "${COMMAND_LOG}"; then exit 1; fi
+if DOCKER_TAG_VERSION=latest bash "${SCRIPT_DIR}/goreleaser-snapshot-artifacts.sh" push-edge; then exit 1; fi
+echo "GoReleaser snapshot artifact tests passed"