sync BE

scripts/docker-build-runner.sh

@@ -5,6 +5,7 @@
 #   ./scripts/docker-build-runner.sh --build-id 42 --workdir /path/to/repo
 #
 # Env: see ci-build-and-publish-ota.sh
+# When invoked from PHP (BUILD_LOG_STDOUT_ONLY=1), log via stdout only — parent redirects to build.log.
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -14,27 +15,49 @@ BUILD_ID="${BUILD_ID:-local}"
 LOG_FILE="${BUILD_LOG_FILE:-${ROOT}/out/builds/${BUILD_ID}/build.log}"
 WORK_DIR="${BUILD_WORK_DIR:-${ROOT}}"
 OUT_DIR="${BUILD_OUT_DIR:-${WORK_DIR}/out/builds/${BUILD_ID}}"
+LOG_STDOUT_ONLY="${BUILD_LOG_STDOUT_ONLY:-0}"
 
 mkdir -p "$(dirname "$LOG_FILE")" "$OUT_DIR"
 
-echo "[runner] image=${IMAGE} ci_version=${CI_VERSION} build_id=${BUILD_ID}" | tee -a "$LOG_FILE"
-echo "[runner] workdir=${WORK_DIR} out=${OUT_DIR}" | tee -a "$LOG_FILE"
+log() {
+  if [[ "$LOG_STDOUT_ONLY" == "1" ]]; then
+    echo "$@"
+  else
+    echo "$@" | tee -a "$LOG_FILE"
+  fi
+}
+
+run_logged() {
+  if [[ "$LOG_STDOUT_ONLY" == "1" ]]; then
+    "$@"
+  else
+    "$@" 2>&1 | tee -a "$LOG_FILE"
+  fi
+}
+
+# Git 2.35+ refuses repos owned by another uid (PHP-FPM nginx vs deploy user).
+git_safe() {
+  git -c safe.directory="${WORK_DIR}" "$@"
+}
+
+log "[runner] image=${IMAGE} ci_version=${CI_VERSION} build_id=${BUILD_ID}"
+log "[runner] workdir=${WORK_DIR} out=${OUT_DIR}"
 
 if [[ -n "${GIT_REF:-}" ]] && [[ -d "${WORK_DIR}/.git" ]]; then
-  echo "[runner] syncing git ref=${GIT_REF}" | tee -a "$LOG_FILE"
-  git -C "${WORK_DIR}" fetch origin --prune 2>&1 | tee -a "$LOG_FILE" || true
-  git -C "${WORK_DIR}" checkout "${GIT_REF}" 2>&1 | tee -a "$LOG_FILE" || true
-  git -C "${WORK_DIR}" pull --rebase origin "${GIT_REF}" 2>&1 | tee -a "$LOG_FILE" || true
-  git -C "${WORK_DIR}" rev-parse HEAD 2>&1 | tee -a "$LOG_FILE" || true
+  log "[runner] syncing git ref=${GIT_REF}"
+  run_logged git_safe -C "${WORK_DIR}" fetch origin --prune || true
+  run_logged git_safe -C "${WORK_DIR}" checkout "${GIT_REF}"
+  run_logged git_safe -C "${WORK_DIR}" pull --rebase origin "${GIT_REF}" || true
+  run_logged git_safe -C "${WORK_DIR}" rev-parse HEAD
 fi
 
-docker build \
+run_logged docker build \
   --build-arg ANDROIDCAST_CI_VERSION="${CI_VERSION}" \
   -t "$IMAGE" \
   -f "${ROOT}/Dockerfile" \
-  "${ROOT}" 2>&1 | tee -a "$LOG_FILE"
+  "${ROOT}"
 
-docker run --rm \
+run_logged docker run --rm \
   -v "${WORK_DIR}:/workspace" \
   -v "${ROOT}/out:/workspace/out" \
   -w /workspace \
@@ -50,6 +73,6 @@ docker run --rm \
   -e GIT_SHA="${GIT_SHA:-}" \
   -e RELEASE_NOTES="${RELEASE_NOTES:-}" \
   "$IMAGE" \
-  ./scripts/ci-build-and-publish-ota.sh 2>&1 | tee -a "$LOG_FILE"
+  ./scripts/ci-build-and-publish-ota.sh
 
-echo "[runner] finished build_id=${BUILD_ID}" | tee -a "$LOG_FILE"
+log "[runner] finished build_id=${BUILD_ID}"