BE sync

scripts/docker-build-runner.sh

@@ -6,6 +6,9 @@
 #
 # Env: see ci-build-and-publish-ota.sh
 # When invoked from PHP (BUILD_LOG_STDOUT_ONLY=1), log via stdout only — parent redirects to build.log.
+#
+# Parallel builds: set BUILD_ISOLATE_SOURCE=1 (default from builder) to shallow-clone into
+#   $OUT_DIR/src instead of mutating the shared deploy checkout.
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -16,6 +19,10 @@ LOG_FILE="${BUILD_LOG_FILE:-${ROOT}/out/builds/${BUILD_ID}/build.log}"
 WORK_DIR="${BUILD_WORK_DIR:-${ROOT}}"
 OUT_DIR="${BUILD_OUT_DIR:-${WORK_DIR}/out/builds/${BUILD_ID}}"
 LOG_STDOUT_ONLY="${BUILD_LOG_STDOUT_ONLY:-0}"
+ISOLATE_SOURCE="${BUILD_ISOLATE_SOURCE:-1}"
+CLONE_DEPTH="${BUILD_GIT_DEPTH:-1}"
+SOURCE_DIR="${OUT_DIR}/src"
+DOCKER_WORKSPACE="${WORK_DIR}"
 
 mkdir -p "$(dirname "$LOG_FILE")" "$OUT_DIR"
 
@@ -40,17 +47,74 @@ git_safe() {
   git -c safe.directory="${WORK_DIR}" "$@"
 }
 
-log "[runner] image=${IMAGE} ci_version=${CI_VERSION} build_id=${BUILD_ID}"
-log "[runner] workdir=${WORK_DIR} out=${OUT_DIR}"
+resolve_git_remote() {
+  if [[ -n "${GIT_REMOTE:-}" ]]; then
+    echo "$GIT_REMOTE"
+    return
+  fi
+  if [[ -d "${WORK_DIR}/.git" ]]; then
+    git_safe -C "${WORK_DIR}" remote get-url origin 2>/dev/null || true
+  fi
+}
 
-if [[ -n "${GIT_REF:-}" ]] && [[ -d "${WORK_DIR}/.git" ]]; then
-  log "[runner] syncing git ref=${GIT_REF}"
+prepare_isolated_source() {
+  local ref="${GIT_REF:-}"
+  local remote sha
+  remote="$(resolve_git_remote)"
+  if [[ -z "$ref" || -z "$remote" ]]; then
+    log "[runner] isolate: skip (need GIT_REF and origin remote)"
+    return 0
+  fi
+
+  rm -rf "${SOURCE_DIR}"
+  mkdir -p "${SOURCE_DIR}"
+
+  log "[runner] isolate: shallow clone depth=${CLONE_DEPTH} ref=${ref} -> ${SOURCE_DIR}"
+  if git clone --depth "${CLONE_DEPTH}" --recurse-submodules --shallow-submodules \
+      --single-branch --branch "${ref}" "${remote}" "${SOURCE_DIR}" 2>/dev/null; then
+    :
+  else
+    log "[runner] isolate: branch clone failed; clone default branch then checkout ${ref}"
+    run_logged git clone --depth "${CLONE_DEPTH}" --recurse-submodules --shallow-submodules \
+      "${remote}" "${SOURCE_DIR}"
+    run_logged git -c safe.directory="${SOURCE_DIR}" -C "${SOURCE_DIR}" fetch --depth "${CLONE_DEPTH}" origin "${ref}"
+    run_logged git -c safe.directory="${SOURCE_DIR}" -C "${SOURCE_DIR}" checkout "${ref}"
+  fi
+
+  if [[ -n "${GIT_SHA:-}" ]]; then
+    log "[runner] isolate: checkout pin GIT_SHA=${GIT_SHA}"
+    run_logged git -c safe.directory="${SOURCE_DIR}" -C "${SOURCE_DIR}" checkout "${GIT_SHA}"
+  fi
+
+  run_logged git -c safe.directory="${SOURCE_DIR}" -C "${SOURCE_DIR}" rev-parse HEAD
+  DOCKER_WORKSPACE="${SOURCE_DIR}"
+}
+
+sync_shared_checkout() {
+  if [[ -z "${GIT_REF:-}" ]] || [[ ! -d "${WORK_DIR}/.git" ]]; then
+    return 0
+  fi
+  log "[runner] syncing shared checkout ref=${GIT_REF}"
   run_logged git_safe -C "${WORK_DIR}" fetch origin --prune || true
   run_logged git_safe -C "${WORK_DIR}" checkout "${GIT_REF}"
   run_logged git_safe -C "${WORK_DIR}" pull --rebase origin "${GIT_REF}" || true
+  if [[ -n "${GIT_SHA:-}" ]]; then
+    run_logged git_safe -C "${WORK_DIR}" checkout "${GIT_SHA}"
+  fi
   run_logged git_safe -C "${WORK_DIR}" rev-parse HEAD
+}
+
+log "[runner] image=${IMAGE} ci_version=${CI_VERSION} build_id=${BUILD_ID}"
+log "[runner] workdir=${WORK_DIR} out=${OUT_DIR} isolate=${ISOLATE_SOURCE}"
+
+if [[ "$ISOLATE_SOURCE" == "1" ]]; then
+  prepare_isolated_source
+else
+  sync_shared_checkout
 fi
 
+log "[runner] docker workspace=${DOCKER_WORKSPACE}"
+
 run_logged docker build \
   --build-arg ANDROIDCAST_CI_VERSION="${CI_VERSION}" \
   -t "$IMAGE" \
@@ -58,7 +122,7 @@ run_logged docker build \
   "${ROOT}"
 
 run_logged docker run --rm \
-  -v "${WORK_DIR}:/workspace" \
+  -v "${DOCKER_WORKSPACE}:/workspace" \
   -v "${ROOT}/out:/workspace/out" \
   -w /workspace \
   -e BUILD_ID="${BUILD_ID}" \