Latte
1a039e32ab
Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.
52 lines
2.0 KiB
Bash
Executable File
52 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Remove the Docker resources that THIS job created, and nothing else.
|
|
#
|
|
# Usage: scripts/ci/cleanup_job_resources.sh [image-ref ...]
|
|
#
|
|
# The runner shares one Docker daemon with other jobs and other services, so
|
|
# this script never prunes. It only removes:
|
|
# * per-run networks named aegis-it-* that the job container is attached to
|
|
# (the integration harness joins the job container to its own per-run
|
|
# network only), plus the containers still attached to those networks;
|
|
# * containers started from the exact image refs given as arguments;
|
|
# * the exact image refs given as arguments.
|
|
# Everything is best effort (a failing removal never fails the job).
|
|
set -uo pipefail
|
|
|
|
job_ref=""
|
|
if command -v uv > /dev/null 2>&1 && [ -f tests/integration/harness.py ]; then
|
|
job_ref="$(uv run python -c \
|
|
'from tests.integration.harness import job_container_ref; print(job_container_ref())' \
|
|
2> /dev/null || true)"
|
|
fi
|
|
if [ -z "${job_ref}" ]; then
|
|
job_ref="${HOSTNAME:-}"
|
|
fi
|
|
|
|
if [ -n "${job_ref}" ] && docker container inspect "${job_ref}" > /dev/null 2>&1; then
|
|
job_id="$(docker container inspect --format '{{.Id}}' "${job_ref}")"
|
|
networks="$(docker container inspect \
|
|
--format '{{range $name, $_ := .NetworkSettings.Networks}}{{$name}}{{"\n"}}{{end}}' \
|
|
"${job_ref}" | grep -E '^aegis-it-[0-9a-f]+$' || true)"
|
|
for net in ${networks}; do
|
|
for cid in $(docker network inspect --format '{{range $id, $_ := .Containers}}{{$id}}{{"\n"}}{{end}}' "${net}" 2> /dev/null); do
|
|
if [ "${cid}" != "${job_id}" ]; then
|
|
docker rm -f -v "${cid}" > /dev/null 2>&1 || true
|
|
fi
|
|
done
|
|
docker network disconnect -f "${net}" "${job_id}" > /dev/null 2>&1 || true
|
|
docker network rm "${net}" > /dev/null 2>&1 || true
|
|
echo "removed network ${net}"
|
|
done
|
|
fi
|
|
|
|
for image in "$@"; do
|
|
for cid in $(docker ps -aq --filter "ancestor=${image}" 2> /dev/null); do
|
|
docker rm -f -v "${cid}" > /dev/null 2>&1 || true
|
|
done
|
|
docker rmi "${image}" > /dev/null 2>&1 || true
|
|
echo "removed image ${image}"
|
|
done
|
|
|
|
exit 0
|