feat: add reproducible imgproxy runtime release

2026-07-15 11:25:32 +08:00
parent 87b03f7848
commit 3eee44ef5b
6 changed files with 171 additions and 0 deletions
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Release the independently versioned imgproxy runtime. Never run this from a
+# feature branch; it is intentionally separate from the Portal runtime bundle.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+HOST="${STUDIO_HOST:-john@58.38.22.103}"
+REMOTE_ROOT="${STUDIO_REMOTE_ROOT:-/Users/john/Project}"
+RUNTIME_BASE="$REMOTE_ROOT/imgproxy-runtime"
+INCOMING="$REMOTE_ROOT/incoming/imgproxy-runtime"
+RELEASE_ID="$(date +%Y%m%d-%H%M%S)-$(git -C "$ROOT" rev-parse --short HEAD)"
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/imgproxy-runtime-release.XXXXXX")"
+cleanup() { rm -rf "$TMP"; }
+trap cleanup EXIT
+
+[[ "$(git -C "$ROOT" branch --show-current)" == "main" ]] || { echo 'imgproxy production release must run from main' >&2; exit 1; }
+[[ -z "$(git -C "$ROOT" status --porcelain)" ]] || { echo 'worktree must be clean' >&2; exit 1; }
+git -C "$ROOT" fetch origin main --quiet
+[[ "$(git -C "$ROOT" rev-parse HEAD)" == "$(git -C "$ROOT" rev-parse origin/main)" ]] || { echo 'main must match origin/main' >&2; exit 1; }
+bash "$ROOT/scripts/check-release-ready.sh"
+
+bash "$ROOT/scripts/build-imgproxy-runtime-image.sh"
+IMAGE_DIR="$ROOT/.runtime/imgproxy"
+for file in imgproxy-runtime-image.tar.gz imgproxy-runtime-image.tar.gz.sha256 image-tag.txt; do
+  [[ -f "$IMAGE_DIR/$file" ]] || { echo "missing image artifact: $file" >&2; exit 1; }
+done
+
+mkdir -p "$TMP/runtime"
+cp "$IMAGE_DIR"/* "$TMP/runtime/"
+cp "$ROOT/scripts/install-imgproxy-runtime-prod.sh" "$ROOT/scripts/imgproxy-compat-proxy.mjs" "$TMP/runtime/"
+chmod 755 "$TMP/runtime/install-imgproxy-runtime-prod.sh"
+tar -C "$TMP" -czf "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz" runtime
+shasum -a 256 "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz" > "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz.sha256"
+
+ssh -o BatchMode=yes "$HOST" "mkdir -p '$INCOMING'"
+scp -q "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz" "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz.sha256" "$HOST:$INCOMING/"
+ssh -o BatchMode=yes "$HOST" "RELEASE_ID='$RELEASE_ID' RUNTIME_BASE='$RUNTIME_BASE' INCOMING='$INCOMING' bash -s" <<'REMOTE'
+set -euo pipefail
+archive="$INCOMING/imgproxy-runtime-$RELEASE_ID.tar.gz"
+sha="$archive.sha256"
+cd "$INCOMING"
+shasum -a 256 -c "$sha"
+release_dir="$RUNTIME_BASE/releases/$RELEASE_ID"
+mkdir -p "$release_dir" "$RUNTIME_BASE/backups"
+cp "$HOME/Library/LaunchAgents/cn.tkmind.imgproxy-compat.plist" "$RUNTIME_BASE/backups/imgproxy-compat-$RELEASE_ID.plist" 2>/dev/null || true
+tar -xzf "$archive" -C "$release_dir" --strip-components=1
+cd "$release_dir"
+shasum -a 256 -c imgproxy-runtime-image.tar.gz.sha256
+gunzip -c imgproxy-runtime-image.tar.gz | docker load
+image_tag="$(cat image-tag.txt)"
+IMGPROXY_RUNTIME_DIR="$release_dir" IMGPROXY_IMAGE_TAG="$image_tag" bash ./install-imgproxy-runtime-prod.sh
+ln -sfn "$release_dir" "$RUNTIME_BASE/current"
+curl -fsS --max-time 5 http://127.0.0.1:20082/health >/dev/null
+curl -fsS --max-time 5 http://10.10.0.2:20081/health >/dev/null
+REMOTE
+
+curl -kfsS --max-time 15 https://img.tkmind.cn/health >/dev/null
+printf 'imgproxy release verified: %s\n' "$RELEASE_ID"