ci(deploy): 镜像发布 - 原生多架构构建并复用提交镜像与缓存

.github/scripts/promote-image.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${IMAGE:?}" "${GITHUB_SHA:?}" "${GITHUB_REF:?}" "${DIGEST_DIR:?}" "${EXPECTED_DIGESTS:?}"
+[[ "$GITHUB_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "Invalid commit SHA" >&2; exit 1; }
+shopt -s nullglob
+files=("$DIGEST_DIR"/*)
+[[ ${#files[@]} -eq "$EXPECTED_DIGESTS" ]] || { echo "Incomplete image digest set" >&2; exit 1; }
+sources=()
+for file in "${files[@]}"; do
+  digest=${file##*/}
+  [[ "$digest" =~ ^[0-9a-f]{64}$ ]] || { echo "Invalid image digest" >&2; exit 1; }
+  sources+=("$IMAGE@sha256:$digest")
+done
+
+tags=(--tag "$IMAGE:sha-$GITHUB_SHA" --tag "$IMAGE:sha-${GITHUB_SHA:0:7}")
+if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+  [[ "${VERSION_TAG:?}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] || { echo "Invalid version image tag" >&2; exit 1; }
+  tags+=(--tag "$IMAGE:$VERSION_TAG")
+elif [[ "$GITHUB_REF" == refs/heads/main ]]; then
+  current_sha=$(gh api "repos/${GITHUB_REPOSITORY:?}/git/ref/heads/main" --jq '.object.sha')
+  [[ "$current_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "Invalid main branch SHA" >&2; exit 1; }
+  if [[ "$current_sha" == "$GITHUB_SHA" ]]; then
+    tags+=(--tag "$IMAGE:latest")
+  else
+    echo 'A newer main commit exists; leaving latest unchanged.'
+  fi
+fi
+
+docker buildx imagetools create "${tags[@]}" "${sources[@]}"