Run staging workflows with pinned Node tooling

2026-08-05 14:11:11 +08:00
parent 54b886fce9
commit 91a4da96c9
3 changed files with 107 additions and 2 deletions
@@ -28,7 +28,7 @@ concurrency:
 jobs:
  deploy:
    if: gitea.event_name == 'workflow_dispatch' || (gitea.event.workflow_run.conclusion == 'success' && gitea.event.workflow_run.event == 'push' && gitea.event.workflow_run.head_branch == 'staging')
-    runs-on: xiaoxin
+    runs-on: manman-linux
    timeout-minutes: 30
    env:
      GITEA_SHA: ${{ gitea.sha }}
@@ -105,6 +105,46 @@ jobs:
          git checkout --detach --force origin/main
          git merge-base --is-ancestor "$DEPLOY_SHA" HEAD || { echo "staging revision is not in trusted main history" >&2; exit 1; }

+      - name: Prepare pinned Node tooling
+        env:
+          NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
+          NODE_TOOL_IMAGE: node:22-bookworm-slim
+        run: |
+          set -euo pipefail
+          if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
+            for attempt in 1 2 3; do
+              if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then
+                break
+              fi
+              if [ "$attempt" -eq 3 ]; then
+                echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2
+                exit 1
+              fi
+              sleep $((attempt * 15))
+            done
+          fi
+          docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE"
+          docker image inspect "$NODE_TOOL_IMAGE" >/dev/null
+          tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")"
+          cat > "$tool_dir/node" <<'EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
+          workdir="$(pwd -P)"
+          exec docker run --rm \
+            --user "$(id -u):$(id -g)" \
+            --volume "$workdir:$workdir" \
+            --workdir "$workdir" \
+            --env HOME=/tmp \
+            node:22-bookworm-slim "${0##*/}" "$@"
+          EOF
+          chmod 0755 "$tool_dir/node"
+          ln -s node "$tool_dir/npm"
+          test -n "${GITHUB_PATH:-}"
+          printf '%s\n' "$tool_dir" >> "$GITHUB_PATH"
+          export PATH="$tool_dir:$PATH"
+          node --version
+          npm --version
+
      - name: Download gate-produced image manifest
        env:
          GATE_RUN_ID: ${{ steps.revision.outputs.gate_run_id }}
@@ -19,7 +19,7 @@ concurrency:

 jobs:
  migrate:
-    runs-on: xiaoxin
+    runs-on: manman-linux
    timeout-minutes: 20
    env:
      GITEA_SHA: ${{ gitea.sha }}
@@ -75,6 +75,46 @@ jobs:
          git checkout --detach --force origin/main
          git merge-base --is-ancestor "$DEPLOY_SHA" HEAD || { echo "staging revision is not in trusted main history" >&2; exit 1; }

+      - name: Prepare pinned Node tooling
+        env:
+          NODE_TOOL_SOURCE_IMAGE: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-bookworm-slim@sha256:ef343465b6a14bbdf2ab52f6e100ec0659a792464fcf72c462370d88b3df909c
+          NODE_TOOL_IMAGE: node:22-bookworm-slim
+        run: |
+          set -euo pipefail
+          if ! docker image inspect "$NODE_TOOL_SOURCE_IMAGE" >/dev/null 2>&1; then
+            for attempt in 1 2 3; do
+              if timeout 180 docker pull "$NODE_TOOL_SOURCE_IMAGE"; then
+                break
+              fi
+              if [ "$attempt" -eq 3 ]; then
+                echo "Failed to preload $NODE_TOOL_IMAGE after $attempt attempts" >&2
+                exit 1
+              fi
+              sleep $((attempt * 15))
+            done
+          fi
+          docker tag "$NODE_TOOL_SOURCE_IMAGE" "$NODE_TOOL_IMAGE"
+          docker image inspect "$NODE_TOOL_IMAGE" >/dev/null
+          tool_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/jyotisha-node-tools.XXXXXX")"
+          cat > "$tool_dir/node" <<'EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
+          workdir="$(pwd -P)"
+          exec docker run --rm \
+            --user "$(id -u):$(id -g)" \
+            --volume "$workdir:$workdir" \
+            --workdir "$workdir" \
+            --env HOME=/tmp \
+            node:22-bookworm-slim "${0##*/}" "$@"
+          EOF
+          chmod 0755 "$tool_dir/node"
+          ln -s node "$tool_dir/npm"
+          test -n "${GITHUB_PATH:-}"
+          printf '%s\n' "$tool_dir" >> "$GITHUB_PATH"
+          export PATH="$tool_dir:$PATH"
+          node --version
+          npm --version
+
      - name: Download gate-produced migration manifest
        env:
          GATE_RUN_ID: ${{ steps.revision.outputs.gate_run_id }}