build-in-container.py

#!/usr/bin/env python3
"""Container-based CFEngine package builder.

Builds CFEngine packages inside Docker containers using the existing build
scripts. Each build runs in a fresh ephemeral container.
"""

import argparse
import datetime
import functools
import hashlib
import json
import logging
import subprocess
import sys
import urllib.request
from pathlib import Path

log = logging.getLogger("build-in-container")

IMAGE_REGISTRY = "ghcr.io/cfengine"
CONFIG_PATH = Path(__file__).resolve().parent / "platforms.json"


@functools.cache
def get_config():
    """Load and cache platform configuration from platforms.json."""
    return json.loads(CONFIG_PATH.read_text())


def detect_source_dir():
    """Find the root directory containing all repos (parent of buildscripts/)."""
    script_dir = Path(__file__).resolve().parent
    # The script lives in buildscripts/, so the source dir is one level up
    source_dir = script_dir.parent
    if not (source_dir / "buildscripts").is_dir():
        log.error(f"Cannot find buildscripts/ in {source_dir}")
        sys.exit(1)
    return source_dir


def dockerfile_hash(dockerfile_path):
    """Compute SHA256 hash of a Dockerfile."""
    return hashlib.sha256(dockerfile_path.read_bytes()).hexdigest()


def image_needs_rebuild(image_tag, current_hash):
    """Check if the Docker image needs rebuilding based on Dockerfile hash."""
    result = subprocess.run(
        [
            "docker",
            "inspect",
            "--format",
            '{{index .Config.Labels "dockerfile-hash"}}',
            image_tag,
        ],
        capture_output=True,
        text=True,
    )
    if result.returncode != 0:
        return True  # Image doesn't exist
    stored_hash = result.stdout.strip()
    return stored_hash != current_hash


def build_image(platform_name, platform_config, script_dir, rebuild=False):
    """Build the Docker image for the given platform."""
    image_tag = f"{platform_config['image_name']}:{platform_config['image_version']}"
    dockerfile_name = platform_config["dockerfile"]
    dockerfile_path = script_dir / "container" / dockerfile_name
    current_hash = dockerfile_hash(dockerfile_path)

    if not rebuild and not image_needs_rebuild(image_tag, current_hash):
        log.info(f"Docker image {image_tag} is up to date.")
        return image_tag

    log.info(f"Building Docker image {image_tag}...")
    cmd = [
        "docker",
        "build",
        "-f",
        str(dockerfile_path),
        "--build-arg",
        f"BASE_IMAGE={platform_config['base_image']}@{platform_config['base_image_sha']}",
        "--label",
        f"dockerfile-hash={current_hash}",
        "-t",
        image_tag,
    ]

    for key, value in platform_config.get("extra_build_args", {}).items():
        cmd.extend(["--build-arg", f"{key}={value}"])

    if rebuild:
        cmd.append("--no-cache")

    cmd.extend(["--network", "host"])

    # Build context is the container/ directory
    cmd.append(str(script_dir / "container"))

    result = subprocess.run(cmd)
    if result.returncode != 0:
        log.error("Docker image build failed.")
        sys.exit(1)

    return image_tag


def registry_image_ref(platform_name):
    """Return the fully-qualified registry image reference for a platform."""
    platform = get_config()[platform_name]
    return f"{IMAGE_REGISTRY}/{platform['image_name']}:{platform['image_version']}"


def pull_image(platform_name):
    """Pull a pre-built image from the registry.

    Returns the image reference on success or None on failure.
    """
    ref = registry_image_ref(platform_name)
    log.info(f"Pulling image {ref}...")
    result = subprocess.run(
        ["docker", "pull", ref],
        capture_output=True,
        text=True,
    )
    if result.returncode != 0:
        return None
    return ref


def push_image(platform_name, local_tag):
    """Tag a local image with a timestamped version and push it."""
    image_name = get_config()[platform_name]["image_name"]
    version = datetime.datetime.now(datetime.timezone.utc).strftime("%Y%m%dT%H%M%SZ")
    ref = f"{IMAGE_REGISTRY}/{image_name}:{version}"

    log.info(f"Tagging {local_tag} as {ref}...")
    result = subprocess.run(["docker", "tag", local_tag, ref])
    if result.returncode != 0:
        log.error("Docker tag failed.")
        sys.exit(1)

    log.info(f"Pushing {ref}...")
    result = subprocess.run(["docker", "push", ref])
    if result.returncode != 0:
        log.error("Docker push failed.")
        sys.exit(1)

    log.info(f"Update image_version to \"{version}\" in platforms.json.")


def latest_registry_version(image_name):
    """Query ghcr.io for the latest tag of an image."""
    # Anonymous token — no credentials needed for public images
    token_url = f"https://ghcr.io/token?scope=repository:cfengine/{image_name}:pull"
    token = json.loads(urllib.request.urlopen(token_url).read())["token"]

    tags_url = f"https://ghcr.io/v2/cfengine/{image_name}/tags/list"
    req = urllib.request.Request(
        tags_url, headers={"Authorization": f"Bearer {token}"}
    )
    tags = json.loads(urllib.request.urlopen(req).read()).get("tags", [])
    if not tags:
        return None
    return sorted(tags)[-1]


def update_platform_versions(platform_name=None):
    """Fetch latest image versions from the registry and update platforms.json."""
    config = get_config()

    platforms = [platform_name] if platform_name else list(config.keys())
    for name in platforms:
        image_name = config[name]["image_name"]
        latest = latest_registry_version(image_name)
        if latest is None:
            log.warning(f"No tags found for {image_name}, skipping.")
            continue
        old = config[name]["image_version"]
        if old == latest:
            log.info(f"{name}: already at {latest}")
        else:
            config[name]["image_version"] = latest
            log.info(f"{name}: {old} -> {latest}")

    CONFIG_PATH.write_text(json.dumps(config, indent=2) + "\n")


def latest_base_image_digest(base_image):
    """Fetch current manifest digest from Docker Hub for a base image."""
    # Docker Hub's v2 API path requires a namespace. Official images (ubuntu,
    # debian, ...) live under "library/".
    repo, tag = base_image.rsplit(":", 1)
    repo = f"library/{repo}"

    # The v2 API requires a bearer token even for anonymous public pulls.
    token_url = (
        "https://auth.docker.io/token"
        f"?service=registry.docker.io&scope=repository:{repo}:pull"
    )
    token = json.loads(urllib.request.urlopen(token_url).read())["token"]

    # Accept only the OCI multi-arch index format: this gives the fat manifest
    # digest (what `docker pull` pins to) rather than an arch-specific one.
    # Docker Hub official images are all published as OCI indexes today; if an
    # image is ever served in the older Docker manifest.list.v2 format instead,
    # the registry will reject the request with 406.
    manifest_url = f"https://registry-1.docker.io/v2/{repo}/manifests/{tag}"
    accept = "application/vnd.oci.image.index.v1+json"

    # HEAD skips the manifest body; the digest comes back in a response header.
    req = urllib.request.Request(
        manifest_url,
        headers={"Authorization": f"Bearer {token}", "Accept": accept},
        method="HEAD",
    )
    with urllib.request.urlopen(req) as resp:
        return resp.headers.get("Docker-Content-Digest")


def update_base_image_shas(platform_name=None):
    """Update base_image_sha in platforms.json to the latest Docker Hub digest."""
    config = get_config()

    platforms = [platform_name] if platform_name else list(config.keys())
    for name in platforms:
        base_image = config[name]["base_image"]
        latest = latest_base_image_digest(base_image)
        if latest is None:
            log.warning(f"No digest returned for {base_image}, skipping.")
            continue
        old = config[name]["base_image_sha"]
        if old == latest:
            log.info(f"{name}: {base_image} already at {latest}")
        else:
            config[name]["base_image_sha"] = latest
            log.info(f"{name}: {base_image} {old} -> {latest}")

    CONFIG_PATH.write_text(json.dumps(config, indent=2) + "\n")


def run_container(args, image_tag, source_dir, script_dir):
    """Run the build inside a Docker container."""
    output_dir = Path(args.output_dir).resolve()
    cache_dir = Path(args.cache_dir).resolve()

    # Pre-create host directories so Docker doesn't create them as root
    output_dir.mkdir(parents=True, exist_ok=True)
    cache_dir.mkdir(parents=True, exist_ok=True)

    cmd = ["docker", "run", "--rm", "--network", "host"]

    if args.shell:
        cmd.extend(["-it"])

    # Mounts
    cmd.extend(
        [
            "-v",
            f"{source_dir}:/srv/source:ro",
            "-v",
            f"{cache_dir}:/home/builder/.cache/buildscripts_cache",
            "-v",
            f"{output_dir}:/output",
        ]
    )

    # Environment variables
    # JOB_BASE_NAME is used by deps-packaging/pkg-cache to derive the cache
    # label. Format: "label=<value>". Without it, all platforms share NO_LABEL.
    cache_label = f"label=container_{args.platform}"
    cmd.extend(
        [
            "-e",
            f"PROJECT={args.project}",
            "-e",
            f"BUILD_TYPE={args.build_type}",
            "-e",
            f"EXPLICIT_ROLE={args.role}",
            "-e",
            f"BUILD_NUMBER={args.build_number}",
            "-e",
            f"JOB_BASE_NAME={cache_label}",
            "-e",
            "CACHE_IS_ONLY_LOCAL=yes",
        ]
    )

    if args.version:
        cmd.extend(["-e", f"EXPLICIT_VERSION={args.version}"])

    cmd.append(image_tag)

    if args.shell:
        cmd.append("/bin/bash")
    else:
        cmd.append(str(Path("/srv/source/buildscripts/build-in-container-inner.sh")))

    result = subprocess.run(cmd)
    return result.returncode


def parse_args():
    """Parse and validate command-line arguments."""
    parser = argparse.ArgumentParser(
        description="Build CFEngine packages in Docker containers."
    )
    parser.add_argument(
        "--platform",
        choices=list(get_config().keys()),
        help="Target platform",
    )
    parser.add_argument(
        "--project",
        choices=["community", "nova"],
        help="CFEngine edition",
    )
    parser.add_argument(
        "--role",
        choices=["agent", "hub"],
        help="Component to build",
    )
    parser.add_argument(
        "--build-type",
        dest="build_type",
        choices=["DEBUG", "RELEASE"],
        help="Build type",
    )
    parser.add_argument(
        "--list-platforms",
        action="store_true",
        help="List available platforms and exit",
    )
    parser.add_argument(
        "--source-dir",
        help="Root directory containing repos (default: parent of buildscripts/)",
    )
    parser.add_argument(
        "--output-dir",
        default="./output",
        help="Output directory for packages (default: ./output)",
    )
    parser.add_argument(
        "--cache-dir",
        default=str(Path.home() / ".cache" / "cfengine" / "buildscripts"),
        help="Dependency cache directory",
    )
    parser.add_argument(
        "--rebuild-image",
        action="store_true",
        help="Force rebuild of Docker image (--no-cache)",
    )
    parser.add_argument(
        "--push-image",
        action="store_true",
        help="Build image and push to registry, then exit",
    )
    parser.add_argument(
        "--update",
        action="store_true",
        help="Fetch latest image version from registry and update platforms.json",
    )
    parser.add_argument(
        "--update-sha",
        dest="update_sha",
        action="store_true",
        help="Fetch latest base image digest from Docker Hub and update platforms.json",
    )
    parser.add_argument(
        "--shell",
        action="store_true",
        help="Drop into container shell for debugging",
    )
    parser.add_argument(
        "--build-number",
        default="1",
        help="Build number for package versioning (default: 1)",
    )
    parser.add_argument(
        "--version",
        help="Override version string",
    )
    args = parser.parse_args()

    if args.list_platforms:
        print("Available platforms:")
        for name, config in get_config().items():
            print(f"  {name:15s}  ({config['base_image']})")
        sys.exit(0)

    if args.update or args.update_sha:
        # --platform is optional for these modes; updates all if omitted
        return args

    # --platform is always required (except --list-platforms/--update handled above)
    if not args.platform:
        parser.error("missing required argument --platform")

    if args.push_image:
        # No other arguments are required for --push-image
        return args

    # Validate remaining required arguments for build mode
    if not args.project:
        parser.error("missing required argument --project")
    if not args.role:
        parser.error("missing required argument --role")
    if not args.build_type:
        parser.error("missing required argument --build-type")

    return args


def main():
    args = parse_args()

    logging.basicConfig(
        level=logging.INFO,
        format="%(message)s",
    )

    if args.update:
        update_platform_versions(args.platform)
        return

    if args.update_sha:
        update_base_image_shas(args.platform)
        return

    # Detect source directory
    if args.source_dir:
        source_dir = Path(args.source_dir).resolve()
    else:
        source_dir = detect_source_dir()

    script_dir = source_dir / "buildscripts"

    platform_config = get_config()[args.platform]

    if args.push_image:
        image_tag = build_image(
            args.platform, platform_config, script_dir, rebuild=True
        )
        push_image(args.platform, image_tag)
        return

    # Resolve image: pull from registry, fall back to local build
    if args.rebuild_image:
        image_tag = build_image(
            args.platform, platform_config, script_dir, rebuild=True
        )
    else:
        image_tag = pull_image(args.platform)
        if image_tag is None:
            log.warning("Registry pull failed, building image locally...")
            image_tag = build_image(args.platform, platform_config, script_dir)

    if not args.shell:
        log.info(
            f"Building {args.project} {args.role} for {args.platform} ({args.build_type})..."
        )

    # Run the container
    rc = run_container(args, image_tag, source_dir, script_dir)

    if rc != 0:
        log.error(f"Build failed (exit code {rc}).")
        sys.exit(rc)

    if not args.shell:
        output_dir = Path(args.output_dir).resolve()
        packages = (
            list(output_dir.glob("*.deb"))
            + list(output_dir.glob("*.rpm"))
            + list(output_dir.glob("*.pkg.tar.gz"))
        )
        if packages:
            log.info("Output packages:")
            for p in sorted(packages):
                log.info(f"  {p}")
        else:
            log.warning("No packages found in output directory.")


if __name__ == "__main__":
    main()