Remove obsolete OSV scan script and add new CI scripts for Docker, Java, Node.js, Python, and Task setup

2026-04-27 02:05:42 +00:00 · 2026-03-22 14:11:47 +03:00
parent 3fef4a2a57
commit 520be25095
9 changed files with 365 additions and 38 deletions
@@ -0,0 +1,65 @@
+#!/bin/sh
+# Install Adoptium Temurin JDK with SHA256 verification.
+# Uses the Adoptium assets API to obtain the checksum and download URL
+# directly from the source, avoiding opaque redirects.
+# Source: https://adoptium.net (Eclipse Foundation)
+# Usage: setup-java.sh [major_version]
+set -eu
+
+JAVA_VERSION="${1:-17}"
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+    x86_64)  ARCH="x64" ;;
+    aarch64) ARCH="aarch64" ;;
+    *)       echo "Unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+echo "Installing Temurin JDK ${JAVA_VERSION} (${ARCH})"
+
+ASSETS_API="https://api.adoptium.net/v3/assets/latest/${JAVA_VERSION}/hotspot?architecture=${ARCH}&image_type=jdk&os=linux&vendor=eclipse"
+API_JSON="$(curl -fsSL "$ASSETS_API")"
+
+DOWNLOAD_URL="$(echo "$API_JSON" | sed -n 's/.*"link" *: *"\([^"]*\)".*/\1/p' | head -1)"
+CHECKSUM_URL="$(echo "$API_JSON" | sed -n 's/.*"checksum_link" *: *"\([^"]*\)".*/\1/p' | head -1)"
+EXPECTED="$(echo "$API_JSON" | sed -n 's/.*"checksum" *: *"\([0-9a-f]*\)".*/\1/p' | head -1)"
+
+if [ -z "$DOWNLOAD_URL" ] || [ -z "$EXPECTED" ]; then
+    echo "Failed to resolve Temurin JDK ${JAVA_VERSION} for ${ARCH}" >&2
+    exit 1
+fi
+
+curl -fsSL "$DOWNLOAD_URL" -o /tmp/jdk.tar.gz
+
+ACTUAL="$(sha256sum /tmp/jdk.tar.gz | cut -d' ' -f1)"
+if [ "$EXPECTED" != "$ACTUAL" ]; then
+    echo "SHA256 verification failed for JDK ${JAVA_VERSION}" >&2
+    echo "  expected: ${EXPECTED}" >&2
+    echo "  got:      ${ACTUAL}" >&2
+    rm -f /tmp/jdk.tar.gz
+    exit 1
+fi
+echo "SHA256 verified: ${ACTUAL}"
+
+if [ -n "$CHECKSUM_URL" ]; then
+    EXPECTED_LINK="$(curl -fsSL "$CHECKSUM_URL" | cut -d' ' -f1)"
+    if [ "$EXPECTED_LINK" != "$ACTUAL" ]; then
+        echo "Cross-check against checksum_link also failed" >&2
+        rm -f /tmp/jdk.tar.gz
+        exit 1
+    fi
+    echo "Cross-verified against checksum_link"
+fi
+
+sudo mkdir -p /opt/java
+sudo tar -xzf /tmp/jdk.tar.gz -C /opt/java --strip-components=1
+rm -f /tmp/jdk.tar.gz
+
+CI_ENV="${GITEA_ENV:-${GITHUB_ENV:-/dev/null}}"
+CI_PATH="${GITEA_PATH:-${GITHUB_PATH:-/dev/null}}"
+echo "JAVA_HOME=/opt/java" >> "$CI_ENV"
+echo "/opt/java/bin" >> "$CI_PATH"
+
+export JAVA_HOME=/opt/java
+export PATH="/opt/java/bin:$PATH"
+java -version