opn

scripts/build-release.sh

@@ -3,6 +3,7 @@ set -Eeuo pipefail
 source /opt/rust-package-builder/scripts/lib.sh
 
 SHA=${1:?commit SHA required}
+BUILD_REASON=${2:-new-commit}
 SHORT_SHA=${SHA:0:12}
 BUILD_ID="$(date -u '+%Y%m%dT%H%M%SZ')-${SHORT_SHA}"
 WORK="$DATA_DIR/work/$BUILD_ID"
@@ -100,11 +101,24 @@ HOMEPAGE=${PACKAGE_HOMEPAGE:-${CARGO_HOMEPAGE:-${CARGO_REPOSITORY:-${CONTROL_HOM
 
 REQUESTED_PACKAGE_RELEASE=$PACKAGE_RELEASE
 if [[ "$REQUESTED_PACKAGE_RELEASE" == "auto" ]]; then
+    LAST_COMMIT=""
     LAST_VERSION=""
     LAST_PACKAGE_RELEASE=0
+    [[ -r "$DATA_DIR/state/last_commit" ]] && LAST_COMMIT=$(cat "$DATA_DIR/state/last_commit")
     [[ -r "$DATA_DIR/state/last_version" ]] && LAST_VERSION=$(cat "$DATA_DIR/state/last_version")
     [[ -r "$DATA_DIR/state/last_package_release" ]] && LAST_PACKAGE_RELEASE=$(cat "$DATA_DIR/state/last_package_release")
-    if [[ "$LAST_VERSION" == "$VERSION" && "$LAST_PACKAGE_RELEASE" =~ ^[0-9]+$ ]]; then
+
+    # Repairing an incomplete unified release for the exact same source commit
+    # must not create an artificial new DEB/RPM release number. This is the
+    # migration path from the older Linux-only builder: Linux packages already
+    # exist, while the new OPNsense artifacts still need to be produced.
+    if [[ "$BUILD_REASON" == "repair-missing-artifacts" \
+        && "$LAST_COMMIT" == "$SHA" \
+        && "$LAST_VERSION" == "$VERSION" \
+        && "$LAST_PACKAGE_RELEASE" =~ ^[1-9][0-9]*$ ]]; then
+        PACKAGE_RELEASE=$LAST_PACKAGE_RELEASE
+        log "repair build: reusing Linux package release $PACKAGE_RELEASE for unchanged commit"
+    elif [[ "$LAST_VERSION" == "$VERSION" && "$LAST_PACKAGE_RELEASE" =~ ^[0-9]+$ ]]; then
         PACKAGE_RELEASE=$((LAST_PACKAGE_RELEASE + 1))
     else
         PACKAGE_RELEASE=1
@@ -281,6 +295,7 @@ package_version=$OPNSENSE_PACKAGE_VERSION
 source_url=$SOURCE_REPO
 source_ref=$SOURCE_BRANCH
 source_commit=$SHA
+build_reason=$BUILD_REASON
 source_revision=$SOURCE_REVISION
 opnsense_series=$OPNSENSE_ABI
 freebsd_release=$FREEBSD_RELEASE
@@ -319,4 +334,4 @@ printf '%s\n' "$PACKAGE_RELEASE" | atomic_write "$DATA_DIR/state/last_package_re
 printf '%s\n' "$OPNSENSE_PACKAGE_VERSION" | atomic_write "$DATA_DIR/state/last_opnsense_package_version"
 printf '%s\n' "$BUILD_ID" | atomic_write "$DATA_DIR/state/last_release"
 
-log "build completed: version=$VERSION linux_release=$PACKAGE_RELEASE opnsense=$OPNSENSE_PACKAGE_VERSION commit=$SHA release=$BUILD_ID"
+log "build completed: reason=$BUILD_REASON version=$VERSION linux_release=$PACKAGE_RELEASE opnsense=$OPNSENSE_PACKAGE_VERSION commit=$SHA release=$BUILD_ID"

scripts/check-and-build.sh

@@ -3,6 +3,36 @@ set -Eeuo pipefail
 source /opt/rust-package-builder/scripts/lib.sh
 
 STATE_FILE="$DATA_DIR/state/last_commit"
+REPOSITORY="$DATA_DIR/repository"
+
+published_release_complete_for_commit() {
+    local sha=$1
+    local current="$REPOSITORY/current"
+    local opnsense="$current/opnsense"
+    local package_dir="$opnsense/$OPNSENSE_ABI/amd64"
+
+    [[ -d "$current" ]] || return 1
+
+    # Linux side of the atomic release.
+    [[ -f "$current/apt/dists/$REPO_DISTRIBUTION/InRelease" ]] || return 1
+    [[ -f "$current/rpm/x86_64/repodata/repomd.xml" ]] || return 1
+
+    # OPNsense side. BUILD-INFO ties the published pkg repository to the same
+    # source commit so an old Linux-only release cannot be mistaken for a
+    # complete unified release after migration.
+    [[ -f "$opnsense/meta.conf" ]] || return 1
+    [[ -f "$opnsense/packagesite.pkg" ]] || return 1
+    [[ -f "$opnsense/data.pkg" ]] || return 1
+    [[ -f "$opnsense/RustProxy.conf" ]] || return 1
+    [[ -f "$opnsense/BUILD-INFO.txt" ]] || return 1
+    [[ -f "$opnsense/os-rustproxy-latest.pkg" ]] || return 1
+    grep -Fqx "source_commit=$sha" "$opnsense/BUILD-INFO.txt" || return 1
+    grep -Fqx "opnsense_series=$OPNSENSE_ABI" "$opnsense/BUILD-INFO.txt" || return 1
+    [[ -d "$package_dir" ]] || return 1
+    find "$package_dir" -maxdepth 1 -type f -name 'os-rustproxy-*.pkg' -print -quit | grep -q . || return 1
+
+    return 0
+}
 
 log "checking repository"
 REMOTE_SHA=$(git ls-remote "$SOURCE_REPO" "refs/heads/$SOURCE_BRANCH" | awk 'NR == 1 {print $1}')
@@ -12,9 +42,15 @@ LAST_SHA=""
 [[ -r "$STATE_FILE" ]] && LAST_SHA=$(cat "$STATE_FILE")
 
 if [[ "$REMOTE_SHA" == "$LAST_SHA" ]]; then
-    log "no changes: $REMOTE_SHA"
+    if published_release_complete_for_commit "$REMOTE_SHA"; then
+        log "no changes and unified release is complete: $REMOTE_SHA"
+        exit 0
+    fi
+
+    log "commit unchanged, but unified release is incomplete; rebuilding missing artifacts for $REMOTE_SHA"
+    /opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" repair-missing-artifacts
     exit 0
 fi
 
 log "new commit detected: $REMOTE_SHA"
-/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA"
+/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" new-commit