neiam /lambent-ex-plasmoid

public · Issues · Pulls · Labels · Forks · Compare · Actions success · Badges · Packages

Package without bind mounts: lift nfpm out of its image

e350ba8 · gmorell · 2026-11-05 18:40

5 files +24 -13

Message

{commit_body(@commit)}

Files changed

modified .forgejo/workflows/package.yml

+6 −2

@@ -62,10 +62,14 @@ jobs:

62	62	export HOMEPAGE="$FORGE_URL/$REPOSITORY"
63	63
64	64	rm -rf dist
	65	+ # Assigned before it's echoed: `echo "$(build.sh)"` would
	66	+ # swallow a failed build and hand Publish an empty path.
65	67	for suite in $SUITES; do
66		− echo "deb $suite $(packaging/build.sh deb "$suite")" >> packages.txt
	68	+ package=$(packaging/build.sh deb "$suite")
	69	+ echo "deb $suite $package" >> packages.txt
67	70	done
68		− echo "rpm - $(packaging/build.sh rpm)" >> packages.txt
	71	+ package=$(packaging/build.sh rpm)
	72	+ echo "rpm - $package" >> packages.txt
69	73	mv packages.txt dist/
70	74	cat dist/packages.txt
71	75

modified packaging/build.sh

+18 −11

@@ -110,21 +110,28 @@ before=$(ls -1 "$out" | sort)

110	110
111	111	rel_config=${config#"$root/"}
112	112	if command -v nfpm >/dev/null 2>&1; then
113		− (cd "$root" && nfpm package -f "$rel_config" -p "$format" -t dist/) >&2
	113	+ nfpm=nfpm
114	114	else
	115	+ # nfpm is one static binary; lift it out of its image rather than
	116	+ # running the image. On the CI runner the job is itself a container
	117	+ # talking to the host's daemon, so a bind mount of the checkout names
	118	+ # a path the daemon can't see — but create/cp go over the API and
	119	+ # need no shared filesystem.
115	120	image=${NFPM_IMAGE:-docker.io/goreleaser/nfpm:v2.41.0}
116		− if command -v docker >/dev/null 2>&1; then
117		− run=(docker run --rm --user "$(id -u):$(id -g)" -v "$root:/w")
118		− elif command -v podman >/dev/null 2>&1; then
119		− # keep-id: files come out owned by the caller, not a subuid.
120		− run=(podman run --rm --userns=keep-id -v "$root:/w:z")
121		− else
122		− echo "need nfpm, docker or podman" >&2
123		− exit 1
	121	+ nfpm=$out/.bin/nfpm-${image##*:}
	122	+ if [ ! -x "$nfpm" ]; then
	123	+ if command -v docker >/dev/null 2>&1; then engine=docker
	124	+ elif command -v podman >/dev/null 2>&1; then engine=podman
	125	+ else echo "need nfpm, docker or podman" >&2; exit 1
	126	+ fi
	127	+ mkdir -p "$out/.bin"
	128	+ container=$("$engine" create "$image")
	129	+ trap '"$engine" rm -f "$container" >/dev/null' EXIT
	130	+ "$engine" cp "$container:/usr/bin/nfpm" "$nfpm.tmp" >&2
	131	+ chmod +x "$nfpm.tmp" && mv "$nfpm.tmp" "$nfpm"
124	132	fi
125		− "${run[@]}" -e SOURCE_DATE_EPOCH -w /w "$image" \
126		− package -f "$rel_config" -p "$format" -t dist/ >&2
127	133	fi
	134	+(cd "$root" && "$nfpm" package -f "$rel_config" -p "$format" -t dist/) >&2
128	135
129	136	made=$(comm -13 <(echo "$before") <(ls -1 "$out" \| sort) \| grep "\.$format\$" \|\| true)
130	137	if [ "$(echo "$made" \| grep -c .)" != 1 ]; then

Parents: cc97953