0.2.64 update

2026-08-15 09:23:26 +12:00
parent a2ca7e8061
commit d5d47473a2
90 changed files with 9188 additions and 451 deletions
@@ -0,0 +1,54 @@
+# syntax=docker/dockerfile:1.7
+
+FROM golang:1.26-alpine AS controller
+WORKDIR /src
+COPY controller.go .
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/memby-builder-controller controller.go
+
+FROM eclipse-temurin:17-jdk-jammy
+
+ARG ANDROID_COMMAND_LINE_TOOLS_VERSION=15859902
+ARG ANDROID_COMMAND_LINE_TOOLS_SHA256=4e4c464f145a7512b57d088ac6c278c03c9eea610886b35a5e0804e74eedf583
+ARG ANDROID_PLATFORM=35
+ARG ANDROID_BUILD_TOOLS=35.0.0
+
+ENV ANDROID_HOME=/opt/android-sdk \
+    ANDROID_SDK_ROOT=/opt/android-sdk \
+    GRADLE_USER_HOME=/home/memby/.gradle \
+    PATH=/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/platform-tools:/opt/android-sdk/build-tools/35.0.0:${PATH}
+
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        ca-certificates curl git unzip && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p "${ANDROID_HOME}/cmdline-tools" /tmp/android-tools && \
+    curl --fail --location --show-error --silent \
+        "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_COMMAND_LINE_TOOLS_VERSION}_latest.zip" \
+        --output /tmp/android-tools.zip && \
+    echo "${ANDROID_COMMAND_LINE_TOOLS_SHA256}  /tmp/android-tools.zip" | sha256sum --check --strict && \
+    unzip -q /tmp/android-tools.zip -d /tmp/android-tools && \
+    mv /tmp/android-tools/cmdline-tools "${ANDROID_HOME}/cmdline-tools/latest" && \
+    yes | sdkmanager --licenses >/dev/null && \
+    sdkmanager \
+        "platform-tools" \
+        "platforms;android-${ANDROID_PLATFORM}" \
+        "build-tools;${ANDROID_BUILD_TOOLS}" && \
+    rm -rf /tmp/android-tools /tmp/android-tools.zip /root/.android
+
+# Match the distroless gateway's non-root uid so both services can safely use the
+# memby-releases volume. The signing material remains a read-only Compose secret.
+RUN groupadd --gid 65532 memby && \
+    useradd --uid 65532 --gid 65532 --create-home --home-dir /home/memby memby && \
+    mkdir -p /work /data/releases "${GRADLE_USER_HOME}" && \
+    chown -R 65532:65532 /work /data/releases /home/memby
+
+COPY --chmod=0755 release.sh /usr/local/bin/memby-builder
+COPY --from=controller --chmod=0755 /out/memby-builder-controller /usr/local/bin/memby-builder-controller
+
+USER 65532:65532
+WORKDIR /work
+ENTRYPOINT ["/usr/local/bin/memby-builder"]
+CMD ["release"]