draft: ci: build container image

ci/Jenkinsfile

@@ -47,11 +47,25 @@ pipeline {
 
         stage('Build') {
             steps {
-                sh 'make -C buildroot O="${PWD}"/_build BR2_EXTERNAL="${PWD}" pythonctnr_defconfig'
-                sh 'make -C _build'
+                sh '. ci/build.sh'
+            }
+        }
+
+        stage('Build Container') {
+            steps {
+                container('buildah') {
+                    sh '. ci/build-container.sh'
+                }
+            }
+        }
+
+        stage('Publish Container') {
+            steps {
+                container('buildah') {
+                    sh '. ci/publish-container.sh'
+                }
             }
         }
 
     }
-
 }

ci/build-container.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+. ci/container-common.sh
+
+ctnr=$(buildah from scratch)
+buildah add ${ctnr} _build/images/rootfs.tar /
+buildah config --cmd python ${ctnr}
+buildah commit ${ctnr} pythonctnr:$(tag_name ${BUILD_TAG})

ci/build.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+# vim: set sw=4 ts=4 sts=4 et :
+
+make -C buildroot O="${PWD}"/_build BR2_EXTERNAL="${PWD}" pythonctnr_defconfig
+make -C _build

ci/container-common.sh

@@ -0,0 +1,5 @@
+# shellcheck: shell=sh
+
+tag_name() {
+    echo "$1" | sed -e 's/[^a-zA-Z0-9._-]/-/g' -e 's/^[.-]/_/'
+}

ci/podTemplate.yaml

@@ -13,6 +13,13 @@ spec:
     securityContext:
       readOnlyRootFilesystem: true
       runAsUser: 1000
+  - name: buildah
+    image: quay.io/containers/buildah:v1
+    command:
+    - sleep
+    - infinity
+    securityContext:
+      privileged: true
   volumes:
   - name: tmp
     emptyDir:

ci/publish-container.sh

@@ -0,0 +1,14 @@
+#!/bin/sh -ex
+
+. ci/container-common.sh
+
+push() {
+    tag=$(tag_name "$1")
+    buildah push pythonctnr:$(tag_name ${BUILD_TAG}) registry.pyrocufflink.blue/pythonctnr:${tag}
+}
+
+push ${BUILD_TAG}
+push ${BRANCH_NAME}
+if [ "${BRANCH_NAME}" = master ]; then
+    push latest
+fi