feat: upadte

skills/builder/scripts/check.py

@@ -41,7 +41,13 @@ SECRET_PATTERNS = (
 )
 FLOATING_TAGS = (":latest", ":stable")
 DEB_SHAPE = re.compile(r"^[^_\s]+_[^_\s]+_[^_\s]+\.deb$")
-VALID_SCRIPT_NAMES = ("upload_deb.sh", "publish_docker.sh", "copy_artifact.sh")
+VALID_SCRIPT_NAMES = (
+    "upload_deb.sh",
+    "publish_docker.sh",
+    "copy_artifact.sh",
+    "obtain.sh",
+    "wait_ci.sh",
+)
 BUILDER_MAKEFILE = "makefile.builder"
 BUILDER_ENV = ".env.builder"
 
@@ -354,6 +360,9 @@ SCRIPT_RESOLVE_SNIPPETS = tuple(
         "$$HOME/.skills/skills/builder/scripts",
         "$HOME/.skills/skills/builder/scripts",
         "~/.skills/skills/builder/scripts",
+        "$$HOME/.agents/skills/builder/scripts",
+        "$HOME/.agents/skills/builder/scripts",
+        "~/.agents/skills/builder/scripts",
     )
     for name in VALID_SCRIPT_NAMES
 )
@@ -379,7 +388,12 @@ def check_push_delegates(
     missing = []
     inline = []
     thin = []
-    builder_names = ("upload_deb.sh", "publish_docker.sh", "copy_artifact.sh")
+    builder_names = (
+        "upload_deb.sh",
+        "publish_docker.sh",
+        "copy_artifact.sh",
+        "obtain.sh",
+    )
     for target in targets:
         dry = run_make(project, target)
         if has_no_rule(dry):
@@ -576,12 +590,68 @@ def check_copy_script(
     )
 
 
+def read_venue(project: Path) -> str:
+    result = run_make(project, "venue")
+    if not has_no_rule(result):
+        echoed = parse_dry_echo(result)
+        if echoed in ("local", "ci"):
+            return echoed
+        cleaned = "\n".join(clean_make_output(result)).strip()
+        if cleaned in ("local", "ci"):
+            return cleaned
+    raw = makefile_values(project).get("BUILD_VENUE", "local")
+    raw = re.split(r"\s+#", raw, maxsplit=1)[0].strip()
+    return raw or "local"
+
+
+def origin_forge(project: Path) -> str:
+    result = subprocess.run(
+        ["git", "-C", str(project), "remote", "get-url", "origin"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    url = (result.stdout or "").strip()
+    if "github.com" in url:
+        return "github"
+    if url:
+        return "gitlab"
+    return ""
+
+
 def check_ready_toolchain(
-    report: Report, *, deb_project: bool, docker_project: bool, copy_project: bool = False
+    report: Report,
+    project: Path | None = None,
+    *,
+    deb_project: bool,
+    docker_project: bool,
+    copy_project: bool = False,
 ) -> None:
-    lines = [f"make: {'found' if shutil.which('make') else 'MISSING'}"]
+    venue = read_venue(project) if project is not None else "local"
+    lines = [
+        f"make: {'found' if shutil.which('make') else 'MISSING'}",
+        f"BUILD_VENUE: {venue}",
+    ]
     problems = []
-    if docker_project:
+    if venue not in ("local", "ci"):
+        problems.append("BUILD_VENUE must be local or ci")
+    if docker_project and venue == "ci":
+        docker_ok = shutil.which("docker") is not None
+        lines.append(
+            f"docker: {'found' if docker_ok else 'optional for inspect; obtain fails without it'}"
+        )
+        forge = origin_forge(project) if project is not None else ""
+        if forge == "github":
+            gh_ok = shutil.which("gh") is not None
+            lines.append(f"gh: {'found' if gh_ok else 'MISSING (blocks ci venue)'}")
+            if not gh_ok:
+                problems.append("install gh and authenticate for this GitHub repo")
+        else:
+            glab_ok = shutil.which("glab") is not None
+            lines.append(f"glab: {'found' if glab_ok else 'MISSING (blocks ci venue)'}")
+            if not glab_ok:
+                problems.append("install glab and authenticate for this GitLab project")
+    elif docker_project:
         docker_ok = shutil.which("docker") is not None
         lines.append(f"docker: {'found' if docker_ok else 'MISSING (blocks docker track)'}")
         if not docker_ok:
@@ -682,6 +752,7 @@ def check_script_paths(report: Report) -> None:
     home = Path(os.environ.get("HOME", ""))
     candidates.append(home / ".pouch" / "skills" / "builder" / "scripts")
     candidates.append(home / ".skills" / "skills" / "builder" / "scripts")
+    candidates.append(home / ".agents" / "skills" / "builder" / "scripts")
     found = next((c for c in candidates if c.is_dir() and any((c / n).is_file() for n in VALID_SCRIPT_NAMES)), None)
     if found:
         report.add(PASS, 9, "builder 脚本路径可达", str(found))
@@ -761,7 +832,12 @@ def main(argv: list[str] | None = None) -> int:
             report.add(SKIP, number, title, detail)
         docker_project = detect_docker_project(project)
         deb_project = any(project.glob("debian/*"))
-        check_ready_toolchain(report, deb_project=deb_project, docker_project=docker_project)
+        check_ready_toolchain(
+            report,
+            project,
+            deb_project=deb_project,
+            docker_project=docker_project,
+        )
         check_ready_env_keys(
             report, project, deb_project=deb_project, docker_project=docker_project
         )
@@ -786,6 +862,8 @@ def main(argv: list[str] | None = None) -> int:
         "push-deb",
         "push-docker",
         "push-copy",
+        "obtain",
+        "venue",
     ):
         result = run_make(project, target)
         if result.returncode == 0:
@@ -847,6 +925,7 @@ def main(argv: list[str] | None = None) -> int:
     if args.ready:
         check_ready_toolchain(
             report,
+            project,
             deb_project=deb_project,
             docker_project=docker_project,
             copy_project=copy_project,

skills/builder/scripts/obtain.sh

@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Obtain a verified artifact for an exact git commit.
+# Build may have happened locally or in CI; this script only reports identity
+# after the artifact exists. Does not print tokens.
+#
+# Usage:
+#   obtain.sh [--sha SHA] [--branch NAME] [--root DIR] [--timeout SEC]
+#
+# BUILD_VENUE (makefile.builder, default local):
+#   local  HEAD must be SHA; run `make -f makefile.builder docker` or `deb`
+#   ci     wait for the forge pipeline of this SHA, then inspect the image
+#
+# Exit:
+#   0  artifact verified; prints ARTIFACT= / DIGEST= / SHA= / VENUE=
+#   1  no pipeline, job failed, inspect failed
+#   2  usage / config
+#   3  forge CLI cannot read the project (ci venue)
+
+usage() {
+  sed -n '2,20p' "$0"
+}
+
+sha=
+branch=
+root=
+timeout_sec=1200
+
+while (($#)); do
+  case "$1" in
+    --sha) sha=$2; shift 2 ;;
+    --branch) branch=$2; shift 2 ;;
+    --root) root=$2; shift 2 ;;
+    --timeout) timeout_sec=$2; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "Error: unknown argument: $1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+
+if [[ -z "$root" ]]; then
+  root=$(git rev-parse --show-toplevel 2>/dev/null || true)
+fi
+if [[ -z "$root" ]]; then
+  echo "Error: --root must be a git project" >&2
+  exit 2
+fi
+cd "$root"
+
+if [[ -z "$sha" ]]; then
+  sha=$(git rev-parse HEAD)
+else
+  sha=$(git rev-parse "$sha")
+fi
+
+# Load .env.builder without printing values; shell values win. Do not read `.env`.
+if [[ -f "$root/.env.builder" ]]; then
+  while IFS='=' read -r key value; do
+    key=${key%%[[:space:]]*}
+    [[ -z "$key" || "$key" == \#* ]] && continue
+    if [[ -n "${!key:-}" ]]; then
+      continue
+    fi
+    value=${value%\"}; value=${value#\"}; value=${value%\'}; value=${value#\'}
+    [[ -z "$value" ]] && continue
+    printf -v "$key" '%s' "$value"
+    export "$key"
+  done < <(grep -v '^[[:space:]]*$' "$root/.env.builder")
+fi
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+version_sh=$script_dir/version.sh
+wait_ci=$script_dir/wait_ci.sh
+
+venue=${BUILD_VENUE:-}
+registry=${DOCKER_REGISTRY:-}
+repository=${DOCKER_REPOSITORY:-}
+if [[ -f "$root/makefile.builder" ]]; then
+  if [[ -z "$venue" ]]; then
+    venue=$(make -s -C "$root" -f makefile.builder venue 2>/dev/null || true)
+  fi
+  if [[ -z "$registry" ]]; then
+    registry=$(make -s -C "$root" -f makefile.builder print-DOCKER_REGISTRY 2>/dev/null || true)
+  fi
+  if [[ -z "$repository" ]]; then
+    repository=$(make -s -C "$root" -f makefile.builder print-DOCKER_REPOSITORY 2>/dev/null || true)
+  fi
+fi
+venue=${venue:-local}
+
+docker_tag_for_sha() {
+  local tmp tag
+  tmp=$(mktemp -d "${TMPDIR:-/tmp}/builder-obtain.XXXXXX")
+  git -C "$root" worktree add --detach "$tmp" "$sha" >/dev/null
+  if [[ -n "$branch" ]]; then
+    tag=$(CI_COMMIT_BRANCH="$branch" "$version_sh" -C "$tmp" --docker)
+  else
+    tag=$("$version_sh" -C "$tmp" --docker)
+  fi
+  git -C "$root" worktree remove --force "$tmp" >/dev/null
+  printf '%s' "$tag"
+}
+
+inspect_image() {
+  local image=$1 out digest
+  if ! command -v docker >/dev/null 2>&1; then
+    echo "Error: docker is required to inspect $image" >&2
+    exit 1
+  fi
+  out=$(docker buildx imagetools inspect "$image" 2>/dev/null \
+    || docker manifest inspect "$image" 2>/dev/null \
+    || true)
+  if [[ -z "$out" ]]; then
+    echo "Error: cannot inspect $image" >&2
+    exit 1
+  fi
+  digest=$(printf '%s\n' "$out" | awk '/^Digest:/ {print $2; exit}')
+  if [[ -z "$digest" ]]; then
+    digest=$(python3 -c 'import json,sys
+try:
+    d=json.load(sys.stdin)
+except Exception:
+    sys.exit(0)
+print(d.get("digest") or "")' <<<"$out")
+  fi
+  if [[ -z "$digest" ]]; then
+    echo "Error: inspect of $image had no digest" >&2
+    exit 1
+  fi
+  printf '%s' "$digest"
+}
+
+case "$venue" in
+  ci)
+    "$wait_ci" --sha "$sha" --root "$root" --timeout "$timeout_sec"
+    if [[ ! -x "$version_sh" ]]; then
+      echo "Error: version.sh not found: $version_sh" >&2
+      exit 2
+    fi
+    if [[ -z "$registry" || -z "$repository" ]]; then
+      echo "Error: DOCKER_REGISTRY and DOCKER_REPOSITORY are required to inspect the CI image" >&2
+      exit 2
+    fi
+    tag=$(docker_tag_for_sha)
+    image="${registry}/${repository}:${tag}"
+    digest=$(inspect_image "$image")
+    echo "ARTIFACT=$image"
+    echo "DIGEST=$digest"
+    echo "SHA=$sha"
+    echo "VENUE=ci"
+    echo "TAG=$tag"
+    ;;
+  local)
+    head=$(git rev-parse HEAD)
+    if [[ "$head" != "$sha" ]]; then
+      echo "Error: local obtain requires HEAD=$sha (HEAD is $head)" >&2
+      exit 2
+    fi
+    if [[ ! -f "$root/makefile.builder" ]]; then
+      echo "Error: no makefile.builder" >&2
+      exit 2
+    fi
+    if make -s -C "$root" -f makefile.builder -n docker >/dev/null 2>&1; then
+      make -C "$root" -f makefile.builder docker
+      if [[ -n "${IMAGE_TAG:-}" ]]; then
+        tag=$IMAGE_TAG
+      elif [[ -x "$version_sh" ]]; then
+        tag=$("$version_sh" --docker)
+      else
+        echo "Error: cannot derive IMAGE_TAG" >&2
+        exit 2
+      fi
+      name=$(make -s -C "$root" -f makefile.builder print-PROJECT_NAME 2>/dev/null || basename "$root")
+      image="${name}:${tag}"
+      if [[ -n "$registry" && -n "$repository" ]]; then
+        image="${registry}/${repository}:${tag}"
+      fi
+      echo "ARTIFACT=$image"
+      echo "DIGEST=local"
+      echo "SHA=$sha"
+      echo "VENUE=local"
+      echo "TAG=$tag"
+    elif make -s -C "$root" -f makefile.builder -n deb >/dev/null 2>&1; then
+      make -C "$root" -f makefile.builder deb
+      echo "ARTIFACT=deb"
+      echo "SHA=$sha"
+      echo "VENUE=local"
+    else
+      echo "Error: local venue has no docker or deb target" >&2
+      exit 2
+    fi
+    ;;
+  *)
+    echo "Error: BUILD_VENUE must be local or ci (got ${venue})" >&2
+    exit 2
+    ;;
+esac

skills/builder/scripts/wait_ci.sh

@@ -0,0 +1,269 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Wait until the forge pipeline for an exact commit SHA finishes.
+# Does not trigger a pipeline. Does not print tokens.
+#
+# Usage:
+#   wait_ci.sh --sha SHA [--root DIR] [--timeout SEC]
+#
+# Exit:
+#   0  pipeline succeeded; prints "OK pipeline=<url> sha=<sha>"
+#   1  no pipeline for this SHA, or a job failed/canceled
+#   2  usage / bad arguments
+#   3  forge CLI missing, or it cannot read this project
+
+usage() {
+  sed -n '2,16p' "$0"
+}
+
+sha=
+root=
+timeout_sec=1200
+poll_sec=10
+appear_sec=90
+
+while (($#)); do
+  case "$1" in
+    --sha) sha=$2; shift 2 ;;
+    --root) root=$2; shift 2 ;;
+    --timeout) timeout_sec=$2; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "Error: unknown argument: $1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+
+if [[ -z "$root" ]]; then
+  root=$(git rev-parse --show-toplevel 2>/dev/null || true)
+fi
+if [[ -z "$root" || ! -d "$root/.git" && ! -f "$root/.git" ]]; then
+  echo "Error: --root must be a git project" >&2
+  exit 2
+fi
+if [[ -z "$sha" ]]; then
+  echo "Error: --sha is required" >&2
+  exit 2
+fi
+sha=$(git -C "$root" rev-parse "$sha")
+
+origin=$(git -C "$root" remote get-url origin 2>/dev/null || true)
+if [[ -z "$origin" ]]; then
+  echo "Error: no origin remote" >&2
+  exit 2
+fi
+
+python_json() {
+  python3 -c "$1"
+}
+
+parse_origin() {
+  python_json '
+import os, re, sys
+url = os.environ["WAIT_CI_ORIGIN"]
+url = url.strip()
+url = re.sub(r"^git@", "ssh://git@", url)
+url = re.sub(r"^ssh://git@([^/]+):", r"ssh://git@\1/", url)
+url = re.sub(r"^https?://", "ssh://git@", url)
+# ssh://git@host/group/repo.git
+m = re.match(r"ssh://git@([^/]+)/(.+?)(?:\.git)?$", url)
+if not m:
+    print("", "", "")
+    raise SystemExit(0)
+host, path = m.group(1), m.group(2)
+kind = "github" if host == "github.com" or host.endswith(".github.com") else "gitlab"
+print(kind, host, path)
+'
+}
+
+export WAIT_CI_ORIGIN=$origin
+read -r forge_kind forge_host forge_path <<<"$(parse_origin)"
+if [[ -z "$forge_kind" || -z "$forge_path" ]]; then
+  echo "Error: cannot parse origin: $origin" >&2
+  exit 2
+fi
+
+gitlab_pipelines() {
+  local encoded
+  encoded=$(python_json 'import os,urllib.parse; print(urllib.parse.quote(os.environ["WAIT_CI_PATH"], safe=""))')
+  glab api "projects/${encoded}/pipelines?sha=${sha}&per_page=20"
+}
+
+gitlab_jobs() {
+  local encoded pid=$1
+  encoded=$(python_json 'import os,urllib.parse; print(urllib.parse.quote(os.environ["WAIT_CI_PATH"], safe=""))')
+  glab api "projects/${encoded}/pipelines/${pid}/jobs"
+}
+
+export WAIT_CI_PATH=$forge_path
+
+if [[ "$forge_kind" == github ]]; then
+  if ! command -v gh >/dev/null 2>&1; then
+    echo "Error: gh is required to watch GitHub Actions for $forge_host" >&2
+    exit 3
+  fi
+else
+  if ! command -v glab >/dev/null 2>&1; then
+    echo "Error: glab is required to watch GitLab CI for $forge_host" >&2
+    exit 3
+  fi
+fi
+
+started=$(date +%s)
+first_seen=0
+empty_since=$started
+
+summarize_gitlab() {
+  python_json '
+import json, os, sys
+raw = sys.stdin.read()
+try:
+    data = json.loads(raw)
+except json.JSONDecodeError:
+    print("error")
+    raise SystemExit(0)
+if isinstance(data, dict) and data.get("message"):
+    print("auth", data.get("message", "")[:80].replace(" ", "_"))
+    raise SystemExit(0)
+if not isinstance(data, list):
+    print("error")
+    raise SystemExit(0)
+if not data:
+    print("empty")
+    raise SystemExit(0)
+p = data[0]
+print(p.get("id"), p.get("status"), p.get("web_url", ""))
+'
+}
+
+summarize_jobs() {
+  python_json '
+import json, sys
+data = json.loads(sys.stdin.read())
+parts = []
+for j in data if isinstance(data, list) else []:
+    parts.append("%s=%s" % (j.get("name"), j.get("status")))
+print(",".join(parts))
+'
+}
+
+github_runs() {
+  gh run list --repo "$forge_path" --commit "$sha" --limit 20 \
+    --json databaseId,status,conclusion,url,headSha
+}
+
+summarize_github() {
+  python_json '
+import json, sys
+data = json.loads(sys.stdin.read())
+if not data:
+    print("empty")
+    raise SystemExit(0)
+r = data[0]
+status = r.get("status")
+conc = r.get("conclusion")
+if status == "completed" and conc == "success":
+    st = "success"
+elif status == "completed":
+    st = conc or "failed"
+else:
+    st = status or "running"
+print(r.get("databaseId"), st, r.get("url", ""))
+'
+}
+
+probe_auth() {
+  if [[ "$forge_kind" == github ]]; then
+    local out rc
+    set +e
+    out=$(github_runs 2>&1)
+    rc=$?
+    set -e
+    if [[ $rc -ne 0 ]]; then
+      echo "Error: gh cannot list runs for $forge_path" >&2
+      echo "$out" | sed '/token/Id; /Bearer/d' >&2
+      exit 3
+    fi
+    return
+  fi
+  local out rc
+  set +e
+  out=$(gitlab_pipelines 2>&1)
+  rc=$?
+  set -e
+  if [[ $rc -ne 0 ]]; then
+    echo "Error: glab cannot list pipelines for $forge_path on $forge_host" >&2
+    echo "$out" | sed '/token/Id; /Bearer/d' >&2
+    exit 3
+  fi
+  local kind
+  kind=$(printf '%s' "$out" | summarize_gitlab | awk '{print $1}')
+  if [[ "$kind" == auth ]]; then
+    echo "Error: glab is authenticated but cannot read $forge_path" >&2
+    exit 3
+  fi
+}
+
+probe_auth
+
+status_line() {
+  if [[ "$forge_kind" == github ]]; then
+    github_runs | summarize_github
+  else
+    gitlab_pipelines | summarize_gitlab
+  fi
+}
+
+while true; do
+  now=$(date +%s)
+  if (( now - started > timeout_sec )); then
+    echo "FAIL reason=timeout sha=$sha" >&2
+    exit 1
+  fi
+  line=$(status_line)
+  set -- $line
+  kind=${1:-empty}
+
+  if [[ "$kind" == empty ]]; then
+    if (( now - empty_since > appear_sec )); then
+      echo "FAIL reason=no_pipeline sha=$sha origin=$forge_host/$forge_path" >&2
+      echo "This SHA has no CI pipeline. Tag or push a ref the project actually builds." >&2
+      exit 1
+    fi
+    sleep "$poll_sec"
+    continue
+  fi
+  if [[ "$kind" == error || "$kind" == auth ]]; then
+    echo "Error: unexpected forge response for $forge_path" >&2
+    exit 3
+  fi
+
+  pid=$1
+  st=$2
+  url=$3
+  empty_since=$now
+  if [[ "$first_seen" -eq 0 ]]; then
+    echo "Watching pipeline $pid status=$st $url" >&2
+    first_seen=1
+  fi
+
+  case "$st" in
+    success)
+      echo "OK pipeline=$url sha=$sha id=$pid"
+      exit 0
+      ;;
+    failed|canceled|cancelled|skipped)
+      jobs_s=
+      if [[ "$forge_kind" != github ]]; then
+        jobs_s=$(gitlab_jobs "$pid" | summarize_jobs || true)
+      fi
+      echo "FAIL reason=job_$st sha=$sha pipeline=$url jobs=$jobs_s" >&2
+      exit 1
+      ;;
+    created|pending|running|waiting_for_resource|preparing|waiting|queued|in_progress|waiting_for_resource)
+      sleep "$poll_sec"
+      ;;
+    *)
+      sleep "$poll_sec"
+      ;;
+  esac
+done