Wire Forge-native release infrastructure

Scripts/ci/backup-garage-to-gcs.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${BURROW_GARAGE_ENDPOINT:?BURROW_GARAGE_ENDPOINT is required}"
+: "${AWS_ACCESS_KEY_ID:?AWS_ACCESS_KEY_ID is required for Garage backup}"
+: "${AWS_SECRET_ACCESS_KEY:?AWS_SECRET_ACCESS_KEY is required for Garage backup}"
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "${repo_root}"
+
+if ! command -v aws >/dev/null 2>&1; then
+  echo "aws CLI is required for Garage backup" >&2
+  exit 127
+fi
+
+if ! command -v gcloud >/dev/null 2>&1; then
+  echo "gcloud is required for GCS backup" >&2
+  exit 127
+fi
+
+if ! gcloud auth list --filter=status:ACTIVE --format='value(account)' | grep -q .; then
+  Scripts/ci/google-wif-auth.sh
+fi
+
+export AWS_DEFAULT_REGION="${BURROW_GARAGE_REGION:-garage}"
+export AWS_EC2_METADATA_DISABLED=true
+
+requested_releases=0
+requested_packages=0
+requested_nix_cache=0
+IFS=',' read -r -a requested_items <<< "${BURROW_GARAGE_BACKUP_SET:-all}"
+
+for raw_item in "${requested_items[@]}"; do
+  item="${raw_item//[[:space:]]/}"
+  case "$item" in
+    "" )
+      ;;
+    all )
+      requested_releases=1
+      requested_packages=1
+      requested_nix_cache=1
+      ;;
+    release|releases )
+      requested_releases=1
+      ;;
+    package|packages )
+      requested_packages=1
+      ;;
+    attic|nix|nix-cache|nix_cache )
+      requested_nix_cache=1
+      ;;
+    * )
+      echo "unknown Garage backup set item: $item" >&2
+      exit 64
+      ;;
+  esac
+done
+
+if [[ "$requested_releases" == "0" && "$requested_packages" == "0" && "$requested_nix_cache" == "0" ]]; then
+  echo "no Garage backup buckets selected" >&2
+  exit 1
+fi
+
+work_root="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/burrow-garage-backup"
+rsync_flags=(--recursive)
+if [[ "${BURROW_GARAGE_BACKUP_DELETE:-false}" == "true" ]]; then
+  rsync_flags+=(--delete-unmatched-destination-objects)
+fi
+
+sync_bucket() {
+  local name="$1"
+  local garage_bucket="$2"
+  local gcs_bucket="$3"
+  local source_dir="${work_root}/${name}"
+
+  rm -rf "$source_dir"
+  mkdir -p "$source_dir"
+
+  aws --endpoint-url "$BURROW_GARAGE_ENDPOINT" s3 sync "s3://${garage_bucket}" "$source_dir" --no-progress
+  gcloud storage rsync "${rsync_flags[@]}" "$source_dir" "gs://${gcs_bucket}"
+}
+
+if [[ "$requested_releases" == "1" ]]; then
+  sync_bucket \
+    releases \
+    "${BURROW_RELEASE_GARAGE_BUCKET:-burrow-releases}" \
+    "${BURROW_RELEASE_GCS_BUCKET:-burrow-net-releases}"
+fi
+
+if [[ "$requested_packages" == "1" ]]; then
+  sync_bucket \
+    packages \
+    "${BURROW_PACKAGE_GARAGE_BUCKET:-burrow-packages}" \
+    "${BURROW_PACKAGE_GCS_BUCKET:-burrow-net-packages}"
+fi
+
+if [[ "$requested_nix_cache" == "1" ]]; then
+  sync_bucket \
+    nix-cache \
+    "${BURROW_NIX_CACHE_GARAGE_BUCKET:-attic}" \
+    "${BURROW_NIX_CACHE_GCS_BUCKET:-burrow-net-nix-cache}"
+fi