Add parallel signing of images to main pipeline

Signed-off-by: Joonas Rautiola <[email protected]>
tiiuae · Nov 1, 2024 · 00d19dc · 00d19dc
1 parent 1089b97
commit 00d19dc
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 11 deletions.
diff --git a/ghaf-main-pipeline.groovy b/ghaf-main-pipeline.groovy
@@ -21,23 +21,32 @@ def flakeAttr = ".#hydraJobs"
 // Target names must be direct children of the above
 def targets = [
   [ target: "docs.aarch64-linux",
-    hwtest_device: null ],
+    archive: false, hwtest_device: null
+  ],
   [ target: "docs.x86_64-linux",
-    hwtest_device: null ],
+    archive: false, hwtest_device: null
+  ],
   [ target: "generic-x86_64-debug.x86_64-linux",
-    hwtest_device: "nuc" ],
+    archive: true, hwtest_device: "nuc"
+  ],
   [ target: "lenovo-x1-carbon-gen11-debug.x86_64-linux",
-    hwtest_device: "lenovo-x1" ],
+    archive: true, hwtest_device: "lenovo-x1"
+  ],
   [ target: "microchip-icicle-kit-debug-from-x86_64.x86_64-linux",
-    hwtest_device: "riscv" ],
+    archive: true, hwtest_device: "riscv"
+  ],
   [ target: "nvidia-jetson-orin-agx-debug.aarch64-linux",
-    hwtest_device: "orin-agx" ],
+    archive: true, hwtest_device: "orin-agx"
+  ],
   [ target: "nvidia-jetson-orin-agx-debug-from-x86_64.x86_64-linux",
-    hwtest_device: "orin-agx" ],
+    archive: true, hwtest_device: "orin-agx"
+  ],
   [ target: "nvidia-jetson-orin-nx-debug.aarch64-linux",
-    hwtest_device: "orin-nx" ],
+    archive: true, hwtest_device: "orin-nx"
+  ],
   [ target: "nvidia-jetson-orin-nx-debug-from-x86_64.x86_64-linux",
-    hwtest_device: "orin-nx" ],
+    archive: true, hwtest_device: "orin-nx"
+  ],
 ]
 
 target_jobs = [:]
@@ -89,14 +98,19 @@ pipeline {
               target_jobs[target] = {
                 stage("Build ${target}") {
                   def opts = ""
-                  if (it['hwtest_device'] != null) {
+                  if (it['archive']) {
                     opts = "--out-link archive/${target}"
                   } else {
                     opts = "--no-link"
                   }
                   try {
                     if (drvPath) {
                       sh "nix build -L ${drvPath}\\^* ${opts}"
+
+                      // only attempt signing if there is something to sign
+                      if (it['archive']) {
+                        utils.sign_target_parallel(target)
+                      }
                     } else {
                       error("Target \"${target}\" was not found in ${flakeAttr}")
                     }
@@ -109,13 +123,16 @@ pipeline {
                   }
                 }
 
-                if (it['hwtest_device'] != null) {
+                if (it['archive']) {
                   stage("Archive ${target}") {
                     script {
                       utils.archive_artifacts("archive", target)
+                      utils.archive_artifacts("sig", target)
                     }
                   }
+                }
 
+                if (it['hwtest_device'] != null) {
                   stage("Test ${target}") {
                     utils.ghaf_parallel_hw_test(target, it['hwtest_device'], '_boot_bat_')
                   }

diff --git a/utils.groovy b/utils.groovy
@@ -61,6 +61,21 @@ def purge_artifacts(String remote_path) {
   run_rclone("purge :webdav:/${remote_path}")
 }
 
+def sign_target_parallel(String target) {
+  img_relpath = sh(
+    script: """
+      cd archive && \
+      find -L ${target} -regex '.*\\.\\(img\\|raw\\|zst\\|iso\\)\$' -print -quit
+    """, returnStdout: true).trim()
+
+  if (!img_relpath) {
+    error("Warning: no image found from 'archive/${target}'")
+  } else {
+    println "Found target '${target}' image '${img_relpath}'"
+    sign_file("archive/${img_relpath}", "sig/${img_relpath}.sig")
+  }
+}
+
 def nix_build(String flakeref, String subdir=null) {
   try {
     flakeref_trimmed = "${flakeref_trim(flakeref)}"