27 lines
1.2 KiB
Docker
27 lines
1.2 KiB
Docker
# The release build of CI (.gitea/workflows/release.yaml) on the toolchain of ./Dockerfile. BuildKit does it all, so
|
|
# the job needs no bind mounts (act_runner's docker resolves those on the host, not in the job): the sources go in as
|
|
# the build context, the signing key as secrets that never land in a layer, Gradle's caches in a cache mount that
|
|
# outlives the build, and the result comes out with --output.
|
|
#
|
|
# docker build -t sleepyowl-ci tools/ci
|
|
# docker build --no-cache -f tools/ci/release.Dockerfile \
|
|
# --secret id=keystore,src=release.jks --secret id=keystore_password,src=password.txt \
|
|
# --secret id=key_alias,src=alias.txt --build-arg VERSION_NAME=0.1.1 -o out .
|
|
#
|
|
# out/ then holds what tools/ci/release.sh lists. --no-cache because secrets are not in the layer cache key: a cached
|
|
# layer would return an APK signed with whatever key built it; the Gradle cache mount survives it.
|
|
ARG CI_IMAGE=sleepyowl-ci
|
|
|
|
FROM ${CI_IMAGE} AS build
|
|
ARG VERSION_NAME=
|
|
WORKDIR /work
|
|
COPY . .
|
|
RUN --mount=type=cache,id=sleepyowl-gradle,target=/gradle,sharing=locked \
|
|
--mount=type=secret,id=keystore \
|
|
--mount=type=secret,id=keystore_password \
|
|
--mount=type=secret,id=key_alias \
|
|
sh tools/ci/release.sh /out
|
|
|
|
FROM scratch
|
|
COPY --from=build /out/ /
|