fix(pikaoa): 已验证产物时降级 BuildKit 收尾错误

scripts/src/pikaoa-test-delivery-renderer.test.ts

@@ -66,6 +66,9 @@ describe("PikaOA test PaC renderer", () => {
         const buildScript = (((task?.taskSpec as Record<string, unknown>).steps as Array<Record<string, unknown>>)[0]?.script) as string;
         expect(buildScript).toContain('"containerimage.digest"[[:space:]]*:[[:space:]]*"\\(sha256:[0-9a-f]\\{64\\}\\)"');
         expect(buildScript).toContain("Docker-Content-Digest:");
+        expect(buildScript).toContain("build_status=$?");
+        expect(buildScript).toContain('"code":"buildctl-nonzero-artifact-verified"');
+        expect(buildScript).toContain('"artifactVerified":true');
       }
       const sourceTask = tasks.find((item) => item.name === "source");
       expect(JSON.stringify(sourceTask)).toContain("source-token");

scripts/src/pikaoa-test-delivery-renderer.ts

@@ -170,6 +170,7 @@ set -eu
 revision="$(params.revision)"
 tag=${shellSingleQuote(imageRepository)}:"$revision"
 metadata=/tmp/${component}-metadata.json
+set +e
 buildctl-daemonless.sh build \\
   --frontend dockerfile.v0 \\
   --local context=. \\
@@ -178,6 +179,8 @@ buildctl-daemonless.sh build \\
   --opt network=${shellSingleQuote(target.build.networkMode)} \\
   --output "type=image,name=$tag,push=true" \\
   --metadata-file "$metadata"
+build_status=$?
+set -e
 metadata_compact=$(tr -d '\\n\\r' < "$metadata")
 digest=$(printf '%s' "$metadata_compact" | sed -n 's/.*"containerimage.digest"[[:space:]]*:[[:space:]]*"\\(sha256:[0-9a-f]\\{64\\}\\)".*/\\1/p' | head -n1)
 if ! printf '%s' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
@@ -187,6 +190,9 @@ if ! printf '%s' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
   digest=$(printf '%s\\n' "$headers" | awk 'BEGIN{IGNORECASE=1} /^[[:space:]]*Docker-Content-Digest:/ {gsub(/\\r/, "", $2); print $2; exit}')
 fi
 case "$digest" in sha256:[0-9a-f][0-9a-f]*) test "\${#digest}" -eq 71 ;; *) echo 'build digest missing from metadata and registry manifest' >&2; exit 3;; esac
+if [ "$build_status" -ne 0 ]; then
+  printf '{"level":"warning","code":"buildctl-nonzero-artifact-verified","component":"${component}","buildctlExitCode":%s,"artifactVerified":true,"valuesPrinted":false}\\n' "$build_status" >&2
+fi
 printf '%s' "$digest" > "$(results.digest.path)"
 printf '%s@%s' ${shellSingleQuote(imageRepository)} "$digest" > "$(results.image.path)"
 printf '{"ok":true,"phase":"${taskName}","sourceCommit":"%s","imageTag":"%s","digest":"%s","valuesPrinted":false}\n' "$revision" "$tag" "$digest"